Dashboards & Visualizations

Default value for dropdown with dynamic datasource in Dashboard Studio

eriktb
Observer
Hello,
 
I have a Dashboard Studio dashboard (Splunk 9.2.3) with a pair of dropdown inputs (“Environment” and “Dependent Dropdown”). The first dropdown, “Environment”, has a static list of items (“Q1", “Q2", “Q3", “Q4"). The items for the second dropdown, “Dependent Dropdown”, has a datasource which dynamically sets the items based on the token set by “Environment”. For example, when “Environment” is set to “Q2”, the items for “Dependent Dropdown” are (“DIRECT", “20", “21", “22", “23"). For each selection of “Environment”, the list of items of “Dependent Dropdown” begins with the value “DIRECT”.
 
The behavior I am trying to achieve is that when a selection is made in “Environment” that the selection in “Dependent Dropdown” be set to the first item (i.e., “DIRECT”) of the newly set item list  determined by the selection for “Environment”.
 
I have tried using the configuration user interface for “Dependent Dropdown” to set “Default selected values” to “First value”. However, when I these steps, the resulting value in “Dependent Dropdown” is “Select a value”:
 
  1. Select “Q2” for “Environment”
  2. Select “21” for “Dependent Dropdown”
  3. Select “Q1” for “Environment”
     
    The result is that “Dependent Dropdown” shows “Select a value”. I would like ”Dependent Dropdown” to show the intended default value (the first value of the item list) of “DIRECT”. 
     
    How can this be achieved?
     
    Thank you in advance for responses,
    Erik
     
    (Source of example dashboard included)
     
     
    Screenshot 2025-02-24 at 11.38.19 AM.png

 

 

{
    "visualizations": {},
    "dataSources": {
        "ds_ouyeecdW": {
            "type": "ds.search",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval env = \"$env$\"\n| eval dependent=case(env=\"Q1\", \"DIRECT\", env=\"Q2\", \"DIRECT;20;21;22;23\", env=\"Q3\", \"DIRECT;30;31\", env=\"Q4\", \"DIRECT;40;41;42;43;44\")\n| makemv dependent delim=\";\"\n| mvexpand dependent\n| table dependent"
            },
            "name": "Search_Dependent_Dropdown"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_ZIhOcc3q": {
            "options": {
                "items": [
                    {
                        "label": "Q1",
                        "value": "Q1"
                    },
                    {
                        "label": "Q2",
                        "value": "Q2"
                    },
                    {
                        "label": "Q3",
                        "value": "Q3"
                    },
                    {
                        "label": "Q4",
                        "value": "Q4"
                    }
                ],
                "token": "env",
                "selectFirstSearchResult": true
            },
            "title": "Environment",
            "type": "input.dropdown"
        },
        "input_1gjNEk0A": {
            "options": {
                "items": [],
                "token": "dependent",
                "selectFirstSearchResult": true
            },
            "title": "Dependent Dropdown",
            "type": "input.dropdown",
            "dataSources": {
                "primary": "ds_ouyeecdW"
            }
        },
        "input_Ih820ou2": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Time Range Input Title",
            "type": "input.timerange"
        }
    },
    "layout": {
        "type": "grid",
        "structure": [],
        "globalInputs": [
            "input_Ih820ou2",
            "input_ZIhOcc3q",
            "input_1gjNEk0A"
        ]
    },
    "description": "",
    "title": "Dependent Dropdown Example"
}

 

 

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The OP is quite old.  It is possible that there was a bug in 9.2.3 that caused selectFirstSearchResult to not take effect.  I can confirm @tej57 's observation that the sample code behaves exactly as you asked in 9.4, too.

Screenshot 2025-06-21 at 6.17.59 PM.png

Screenshot 2025-06-21 at 6.18.15 PM.png

Screenshot 2025-06-21 at 6.19.27 PM.png

Screenshot 2025-06-21 at 6.19.37 PM.png

LAME-Creations
SplunkTrust
SplunkTrust

Mine did the same thing.  It would seem it is your version of Splunk.  Set up a test environment on a laptop or spare VM and run a newer version of Splunk and see if the problem remediates itself.  

0 Karma

tej57
Builder

Hello @eriktb,

Did you try making DIRECT as a static and default value for the dependent dropdown. You can keep the makeresults section as it is to have different values populated based on the environment selection. However, if I understood the request properly, you need the DIRECT value selected by default for any of the environment. And, the case statement also ensures that for any of the environment value, DIRECT is one of the choice for the dependent dropdown. 

Also, when I used your source code in my lab environment, it shows DIRECT as the selected value no matter what the environment dropdown selection is. Check the following screenshots for your reference:

tej57_0-1750332072426.png

tej57_1-1750332094955.png

I'm on Splunk v9.3.2. Let me know if you meant something else and we can think about it.

 

Thanks,
Tejas.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...