Dashboards & Visualizations

Populate dropdown without clicking a first time on the submit button

csimonnet
New Member

Hi everyone,

I have a dashboard with dropdowns with dynamic options and a submit button to run my searches. But my dropdowns are not populated if I don't click on the submit button a first time. How can I change that ?

Thank you for your answers

0 Karma

rbechtold
Communicator

Hey csimonnet,

Have you tried adding the token from your dropdown to your base search?
I made a quick dashboard using makeresults to illustrate the concept:

<form>
  <label>testdash</label>
  <search id="primary">
    <query>|makeresults count=100
| eval logtype = random()%5
| eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", "")))))  
| search $dynamic_dropdown$
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="dynamic_dropdown" searchWhenChanged="true">
      <label>Animal Types</label>
      <choice value="dynamic_field=*">all</choice>
      <default>dynamic_field=*</default>
      <initialValue>dynamic_field=*</initialValue>
      <fieldForLabel>dynamic_field</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>|makeresults count=100
| eval logtype = random()%5
| eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", ""))))) 
| dedup dynamic_field 
| sort dynamic_field 
| eval value="dynamic_field=".dynamic_field</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search base="primary">
          <query>|stats count</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>

Let me break it down:

<search id="primary"> defines your base search. This search will populate all of your other panels based on this high level search.
Typically this search will look something like:
index=your_index sourcetype=your_sourcetype source=your_source | fields field1 field2 field3

You call on this search by adding <search_base="primary"> to any panel that would would like to build on from the base search.
You can see an example of this in the dashboard above:

<search base="primary">
 <query>|stats count</query>
</search>

Notice how the <query> is very small, that's because it's taking the base search as a starting point and adding onto it.

Lastly, notice in the example dashboard I've added |search $dynamic_dropdown$ to my base search. This is a reference to the token that dynamically populates the dropdown with the values from my search. Without this, your dropdown won't have any effects on your dashboard.

The only other thing I can think of to add is the searchWhenChanged="true" option. If you would like your dashboard to only populate when the submit button is pushed, change this to false.

Hopefully this helps.

0 Karma

somesoni2
Revered Legend

Can you post the <fieldset section of your dashboard? Do remember to format the code using "101010" button on top of the text editor here OR select the code and press Ctrl+K.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...