Dashboards & Visualizations

Default value for dropdown with dynamic datasource in Dashboard Studio

eriktb
Observer
Hello,
 
I have a Dashboard Studio dashboard (Splunk 9.2.3) with a pair of dropdown inputs (“Environment” and “Dependent Dropdown”). The first dropdown, “Environment”, has a static list of items (“Q1", “Q2", “Q3", “Q4"). The items for the second dropdown, “Dependent Dropdown”, has a datasource which dynamically sets the items based on the token set by “Environment”. For example, when “Environment” is set to “Q2”, the items for “Dependent Dropdown” are (“DIRECT", “20", “21", “22", “23"). For each selection of “Environment”, the list of items of “Dependent Dropdown” begins with the value “DIRECT”.
 
The behavior I am trying to achieve is that when a selection is made in “Environment” that the selection in “Dependent Dropdown” be set to the first item (i.e., “DIRECT”) of the newly set item list  determined by the selection for “Environment”.
 
I have tried using the configuration user interface for “Dependent Dropdown” to set “Default selected values” to “First value”. However, when I these steps, the resulting value in “Dependent Dropdown” is “Select a value”:
 
  1. Select “Q2” for “Environment”
  2. Select “21” for “Dependent Dropdown”
  3. Select “Q1” for “Environment”
     
    The result is that “Dependent Dropdown” shows “Select a value”. I would like ”Dependent Dropdown” to show the intended default value (the first value of the item list) of “DIRECT”. 
     
    How can this be achieved?
     
    Thank you in advance for responses,
    Erik
     
    (Source of example dashboard included)
     
     
    Screenshot 2025-02-24 at 11.38.19 AM.png

 

 

{
    "visualizations": {},
    "dataSources": {
        "ds_ouyeecdW": {
            "type": "ds.search",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval env = \"$env$\"\n| eval dependent=case(env=\"Q1\", \"DIRECT\", env=\"Q2\", \"DIRECT;20;21;22;23\", env=\"Q3\", \"DIRECT;30;31\", env=\"Q4\", \"DIRECT;40;41;42;43;44\")\n| makemv dependent delim=\";\"\n| mvexpand dependent\n| table dependent"
            },
            "name": "Search_Dependent_Dropdown"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_ZIhOcc3q": {
            "options": {
                "items": [
                    {
                        "label": "Q1",
                        "value": "Q1"
                    },
                    {
                        "label": "Q2",
                        "value": "Q2"
                    },
                    {
                        "label": "Q3",
                        "value": "Q3"
                    },
                    {
                        "label": "Q4",
                        "value": "Q4"
                    }
                ],
                "token": "env",
                "selectFirstSearchResult": true
            },
            "title": "Environment",
            "type": "input.dropdown"
        },
        "input_1gjNEk0A": {
            "options": {
                "items": [],
                "token": "dependent",
                "selectFirstSearchResult": true
            },
            "title": "Dependent Dropdown",
            "type": "input.dropdown",
            "dataSources": {
                "primary": "ds_ouyeecdW"
            }
        },
        "input_Ih820ou2": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Time Range Input Title",
            "type": "input.timerange"
        }
    },
    "layout": {
        "type": "grid",
        "structure": [],
        "globalInputs": [
            "input_Ih820ou2",
            "input_ZIhOcc3q",
            "input_1gjNEk0A"
        ]
    },
    "description": "",
    "title": "Dependent Dropdown Example"
}

 

 

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

The OP is quite old.  It is possible that there was a bug in 9.2.3 that caused selectFirstSearchResult to not take effect.  I can confirm @tej57 's observation that the sample code behaves exactly as you asked in 9.4, too.

Screenshot 2025-06-21 at 6.17.59 PM.png

Screenshot 2025-06-21 at 6.18.15 PM.png

Screenshot 2025-06-21 at 6.19.27 PM.png

Screenshot 2025-06-21 at 6.19.37 PM.png

LAME-Creations
Path Finder

Mine did the same thing.  It would seem it is your version of Splunk.  Set up a test environment on a laptop or spare VM and run a newer version of Splunk and see if the problem remediates itself.  

0 Karma

tej57
Builder

Hello @eriktb,

Did you try making DIRECT as a static and default value for the dependent dropdown. You can keep the makeresults section as it is to have different values populated based on the environment selection. However, if I understood the request properly, you need the DIRECT value selected by default for any of the environment. And, the case statement also ensures that for any of the environment value, DIRECT is one of the choice for the dependent dropdown. 

Also, when I used your source code in my lab environment, it shows DIRECT as the selected value no matter what the environment dropdown selection is. Check the following screenshots for your reference:

tej57_0-1750332072426.png

tej57_1-1750332094955.png

I'm on Splunk v9.3.2. Let me know if you meant something else and we can think about it.

 

Thanks,
Tejas.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...