Dashboards & Visualizations

Empty string token causing multiselect box visual bug

Rolthers
Engager

I am using multiselect boxes to select which search results i want to exclude and include, and when the boxes are cleared, i have some javascript running that sets the tokens to empty strings so that the search can still run without waiting for the tokens to be set again.
However when the tokens are set to empty string by the javascript the multiselect box suddenly becoms twice as big without anything in it.
alt text
Hopefully this picture shows the problem, the empty x i can somewhat live with, but the box suddenly doubling in size is what i would like to avoid since it seems like a bug.
Here is the javascript i use to set to token to "" (empty string)
alt text
Mostly i just wanna avoid the Multiselect Box doubling in size, but alternate solutions to defaulting the tokens to empty values and still allowing the searches to run are also welcome.

0 Karma

jeffland
SplunkTrust
SplunkTrust

I'd suggest using something other than an empty string, maybe giving it a label saying "None" in the Input and a value that does nothing in the search. A value that does nothing in the search could be a comment makro saying "Empty Input Selection". This would not only solve the issue of your unnecessarily large multiselect, it would also be more transparent to both users of the dashboard and someone looking at the search.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...