Dashboards & Visualizations

Dynamic dropdown dashboard with selectFirstChoice-->true doesn't work when you refresh it or share the link

moizmmz
Path Finder

Hello,

I have a dashboard with 4 input dropdowns where three of the dropdowns dynamically populate based on the input value from the first dropdown. Next, there are panels in the dashboard which use the values from these dropdowns to show statistics (they use: true). Search on change and autorun dashboard are both ON.

The problem i'm seeing is that, when i refresh the dashboard or share it's link, the dashboard stops functioning. Splunk version: 6.6.2

Pls help!

Here's my code:

<form>
  <label>Dropdown Example</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="dropdown" token="service_family_tok" searchWhenChanged="true">
      <label>First Drop Down</label>
      <choice value="Match 1">Match 1</choice>
      <choice value="Match 2">Match 2</choice>
      <change>
        <condition value="Match 1">
          <set token="feature_values">Match_1_00,Match_1_360,Match_1_tactical_cam,Match_1_UHD</set>
          <unset token="form.enter_feature_tok"></unset>
        </condition>
        <condition value="Match 2">
          <set token="feature_values">Match_2_00,Match_2_360,Match_2_tactical_cam,Match_2_UHD</set>
          <unset token="form.enter_feature_tok"></unset>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="enter_feature_tok" searchWhenChanged="true">
      <label>Second Dropdown</label>
      <change>
        <condition value="Match_1_00">
          <set token="feature_start_time">1559761200</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559768400</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_1_360">
          <set token="feature_start_time">1559754000</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559772000</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_1_tactical_cam">
          <set token="feature_start_time">1559756400</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559769300</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_1_UHD">
          <set token="feature_start_time">1559761200</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559768400</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_2_00">
          <set token="feature_start_time">1559934000</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559941200</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_2_360">
          <set token="feature_start_time">1559926800</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559944800</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_2_tactical_cam">
          <set token="feature_start_time">1559929200</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559942100</set>
          <unset token="form.mommy"></unset>
        </condition>
        <condition value="Match_2_UHD">
          <set token="feature_start_time">1559934000</set>
          <unset token="form.timmy"></unset>
          <set token="feature_end_time">1559941200</set>
          <unset token="form.mommy"></unset>
        </condition>
      </change>
      <fieldForLabel>feature</fieldForLabel>
      <fieldForValue>feature</fieldForValue>
      <search>
        <query>|makeresults|eval feature="$feature_values$"|makemv feature delim=","|mvexpand feature</query>
        <earliest>-1s@s</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="timmy" searchWhenChanged="true">
      <label>Start time Selection</label>
      <fieldForLabel>start_time</fieldForLabel>
      <fieldForValue>start_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>|makeresults| eval start_time="$feature_start_time$"|makemv start_time delim=","| mvexpand start_time</query>
      </search>
    </input>
    <input type="dropdown" token="mommy" searchWhenChanged="true">
      <label>End time Selection</label>
      <fieldForLabel>end_time</fieldForLabel>
      <fieldForValue>end_time</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>|makeresults| eval end_time="$feature_end_time$"|makemv end_time delim=","| mvexpand end_time</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
       <h3>Service Family Token : $service_family_tok$ , Feature Token : $enter_feature_tok$, Start Time Token: $timmy$, End Time Token: $mommy$</h3>
     </html>
    </panel>
  </row>
  <row>
    <panel>
      <single>
        <search>
          <query>index=dcg_github| stats count</query>
          <earliest>$timmy$</earliest>
          <latest>$mommy$</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>
Tags (1)
0 Karma

niketn
Legend

@moismmz as per your code the token feature_start_time seems to have only one value as epoch time. Under what situation you will have comma separated values? Only if there are multiple values then selectFirstChoice seems useful.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

moizmmz
Path Finder

it's value changes as per the base query. And without selectFirstChoice, it doesn't select any value

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...