How come extra tabs in our drilldown dashboards are opening without apparent cause?

[richkappler]

CONTEXT: I have a group of servers divided into several groups. From the top page, a user makes a choice from a dropdown to get to a dashboard with data from all servers in that group, and from the first drilldown, the user can choose (again from a dropdown) a specific server within the group to open a dashboard with logs specific to the chosen server.

The server lists and groups are fairly maleable, so I have set each of the top 2 dashboards to populate the dropdowns dynamically from a lookup table.

PROBLEM: When I open the top level dash, 1 to 3 of the 1st drilldown open (in new tabs) and either 3 or 9 of the second drilldown opens. This should happen until a choice is made.

top board:

  <fieldset submitButton="false" autoRun="false">
     <input type="dropdown" token="group_tok"  searchWhenChanged="true">
      <label>Bot Category</label>
      <!-- Dynamic definition of choices -->
      <search>
        <query>
          | inputlookup group_ip_host
          | dedup group
          | table group
        </query>
      </search>
      <fieldForLabel>group</fieldForLabel>
      <fieldForValue>group</fieldForValue>
      <change>
        <condition>
          <link target="_blank">
            drilldown1?group_tok=$group_tok$
          </link>
        </condition>
      </change>
    </input>
  </fieldset>

1st drilldown:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="host_tok" searchWhenChanged="true">
      <label>Bot</label>
      <!-- Dynamic definition of choices -->
      <search>
        <query>
          | inputlookup group_ip_host where group=$group_tok$
          | table host
        </query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <change>
        <condition>
          <link target="_blank">drilldown2?host=$host_tok$</link>
        </condition>
      </change>
    </input>
    <input type="time" token="timepicker" searchWhenChanged="true">
      <label>Search Time</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

Any idea why I'm getting these extra tabs opened without a choice actually being made? And why in batches of 3?

I've tried with autoRun=true and false, submitButton=true and false (obviously not at the same time for each) and I get the same behaviour.

[richkappler]

not sure why the code didn't come through, let me try again:
top board:

  <fieldset submitButton="false" autoRun="false">
     <input type="dropdown" token="group_tok"  searchWhenChanged="true">
      <label>Bot Category</label>
      <!-- Dynamic definition of choices -->
      <search>
        <query>
          | inputlookup group_ip_host
          | dedup group
          | table group
        </query>
      </search>
      <fieldForLabel>group</fieldForLabel>
      <fieldForValue>group</fieldForValue>
      <change>
        <condition>
          <link target="_blank">
            drilldown1?group_tok=$group_tok$
          </link>
        </condition>
      </change>
    </input>
  </fieldset>

1st drilldown:

  <fieldset submitButton="false" autoRun="false">
    <input type="dropdown" token="host_tok" searchWhenChanged="true">
      <label>Bot</label>
      <!-- Dynamic definition of choices -->
      <search>
        <query>
          | inputlookup group_ip_host where group=$group_tok$
          | table host
        </query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <change>
        <condition>
          <link target="_blank">drilldown2?host=$host_tok$</link>
        </condition>
      </change>
    </input>
    <input type="time" token="timepicker" searchWhenChanged="true">
      <label>Search Time</label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

[Vijeta]

Instead of using change tag , you can use drilldown tag for displayinng other dashboards. This link may be of help-

https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/DrilldownLinkToDashboard

Also unset the tokens during initialization.