Problem with “Apply Previous Filter” tokens resetting dropdowns in Splunk dashboards

[sanjai]

Hi ,

I’m working on several Splunk dashboards that have dropdown inputs for filtering fields like location, machine, process_id, and department. These filters are all dynamically populated based on searches and tokens.

I use a custom JavaScript feature called “Apply Previous Filter” (APF). It saves filter selections from one dashboard and applies them to another dashboard, so users don’t have to select filters again.

Issue:

• When I open the second dashboard and click APF, the saved filter tokens apply correctly at first.

• I see the correct values in the dropdown filters (dropdown Populates), but after a moment the dropdowns reset to “All” (the default).

• This happens mostly for dropdowns of type <input type="dropdown"> in my XML dashboards for those fields.

• The tokens are still set in the background, but the dropdown UI shows “All”.

Example:

Dashboard 1 has defaults: last 4 hours, index=development, and all dropdowns set to “All”.
I change filters like process_id=15057, location=India, machine=Server-200, and department=The Indian office. APF saves these tokens.

Dashboard 2 starts with same defaults (last 4 hours, development, all “All”).
Clicking APF sets tokens, dropdowns show the saved values briefly, then show “All” again.

What I tried:

• Waiting a few seconds before setting tokens to allow time range changes to apply.

• Listening to search events before applying filters.

• Checking token naming and defaults in XML inputs.
  
  

Can anyone advise:

• Why the dropdown UI resets to “All” after applying tokens even though the tokens hold the right values?

• How to reliably apply the APF tokens so dropdowns show the correct saved filters without resetting?

Thanks a lot for your help!

[sanjai · Accepted solution]

I had a dashboard with multiple dropdowns (index, process_id, machine, location, department) and a time picker.
The process_id and machine inputs used dynamic earliest/latest tokens, while the others had static time ranges.

When restoring tokens via the “Apply Previous Filter” (APF) feature, all inputs were applied simultaneously.
Because of that, machine and process_id were repopulated before index and time were ready — causing them to reset to default.

To fix this, I added a sequential delay logic in JavaScript so filters apply in the correct order:
1. Index and Time range are restored first.
2. After ~800 ms, location and department are applied.
3. After ~1600 ms total, Process_id and machine are restored.

Now, all filters load correctly in sequence.
(No workaround was found from the Splunk XML side)

[ITWhisperer]

Inputs have two tokens, in your case these might be $machine$ and $form.machine$ - the form version is the inbound side of the input and the other is the outbound side of the input. For example, the outbound token would have the prefix applied. Which token or tokens is your javascript updating?

[sanjai]

Tokens Usage:
I verified that the tokens are correctly handled both from the Splunk side (XML input settings) and from the JavaScript side.

• In the XML, each dropdown input uses consistent token names matching what my JS updates.

• My JS applies the tokens via the SplunkJS MVC input GUI .val() method, which correctly updates the inbound token (form.tokenName) and lets Splunk apply prefixes/suffixes to the outbound token (tokenName).

• I confirmed the tokens appear correctly in the Splunk token model after applying APF values.

• Despite this, the dropdown still resets visually after search-driven repopulation, even though the tokens hold correct values.

Further Details:
After I click the APF button, the value in the machine dropdown (for example) gets set correctly—it briefly shows "machine-01" as the selected choice, replacing the default "All".
But when the "Populating" spinner finishes (meaning the search has run and the dropdown options refresh), the selected value resets back to "All".

However, when I manually open the dropdown menu, I see that "machine-01" is listed as one of the choices, so it’s not missing from the available options—Splunk just doesn’t keep it selected, even though it’s valid.

My question:
How can I make the dashboard keep the APF value selected if it is already present as an option after the dropdown finishes repopulating? Is there a recommended technique to re-apply the token, automatically select the previous filter, or avoid this reset when the option exists?