Dashboards & Visualizations

How do I populate a multivalue input with itself during a drilldown?

thisissplunk
Builder

I have a few inputs at the top of my dashboard, one being a multivalue input. Its default is two values, but I often only have one value in there to filter the result show I'd like.

I then click on a field value in a random panel that reloads the dashboard page with the new selected data filtering the entire dashboard. However, this resets the multivalue input back to default. This is not what I want. I've tried this and it places values into the multivalue input instead, but incorrectly so, returning no results:

 <link field="filename">
            <![CDATA[
              /app/Splunk_Files_App/filedata_dashboard?form.filename=$click.value2$&form.index=$index$&form.filetype=$filetype$
            ]]>
 </link>

The problem is the multivalue $filetype$. It literally populates it with "file_type=exe" when I drilldown instead of "EXE".
Here is the multivalue input if needed:

<input type="multiselect" token="filetype" searchWhenChanged="true">
  <label>File name</label>
  <choice value="*">All</choice>
  <default>EXE,PDF</default>
  <search>
    <query>index=$index$ sourcetype=file_data | dedup file_type | table file_type</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldForLabel>file_type</fieldForLabel>
  <fieldForValue>file_type</fieldForValue>
  <!--      Build multi-selection search: 
  EX: (sourcetype ="value1" OR sourcetype ="value2" OR ...)
  -->
  <prefix>(</prefix>
  <valuePrefix>file_type="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <suffix>)</suffix>
</input>

tldr: I try to populate a multivalue input with itself during a drilldown and it doesn't work as expected. How do I do this?

somesoni2
Revered Legend

Try something like this (run anywhere example). See how the multiselect values are formatted (just with delimiter) and how they are used in the search (using subsearch to generate field=value1 OR field=value2... format)

<form>
  <label>Multiselect Dropdown</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="scheduler">scheduler</choice>
      <default>splunkd,splunk_web_access</default>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Sourcetype Distribution</title>
        <search>
          <query>index=_internal [| gentimes start=-1 | eval sourcetype="$sourcetype$" | table sourcetype | makemv sourcetype delim="," | mvexpand sourcetype ]| timechart count by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>

        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
               /app/search/multiselect_dropdown?form.sourcetype=$click.name2$
             ]]>
          </link>
        </drilldown>        
      </chart>
    </panel>
  </row>
</form>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...