Dashboards & Visualizations

Reset multiselect previous value when token is updated

NewToSplunk1
Explorer

I have a dropdown where I select the event name and that event name value is passed as a token to the variable search. This variable search is a multiselect. One issue that I've noticed is that the multiselect values stay populated when a different event is selected. The search for variable will update the dropdown, though. Is there a way to reset the selected variables when a different event is selected?

I have seen the simple xml versions for this but haven't seen any information on how to do this in dashboard stuido.

Any help is greatly appreciated.

{
    "visualizations": {
        "viz_Visualization": {
            "type": "splunk.line",
            "dataSources": {
                "primary": "ds_mainSearch"
            },
            "options": {
                "overlayFields": [],
                "y": "> primary | frameBySeriesNames($dd2|s$)",
                "y2": "> primary | frameBySeriesNames('')",
                "lineWidth": 3,
                "showLineSmoothing": true,
                "xAxisMaxLabelParts": 2,
                "showRoundedY2AxisLabels": false,
                "x": "> primary | seriesByName('_time')"
            },
            "title": "Visualization",
            "containerOptions": {
                "visibility": {}
            },
            "eventHandlers": [
                {
                    "type": "drilldown.linkToSearch",
                    "options": {
                        "type": "auto",
                        "newTab": false
                    }
                }
            ]
        }
    },
    "dataSources": {
        "ds_dd1": {
            "type": "ds.search",
            "options": {
                "query": "index=index  source=source sourcetype=sourcetype |dedup EventName \n| sort str(EventName)"
            },
            "name": "dd1Search"
        },
        "ds_mainSearch": {
            "type": "ds.search",
            "options": {
                "query": "index=index  source=source sourcetype=sourcetype EventName IN (\"$dd1$\") VariableName IN ($dd2|s$) \n| timechart span=5m max(Value) by VariableName",
                "enableSmartSources": true
            },
            "name": "mainSearch"
        },
        "ds_dd2": {
            "type": "ds.search",
            "options": {
                "enableSmartSources": true,
                "query": "index=index  source=source sourcetype=sourcetype EventName = \"$dd1$\" |dedup VariableName \n| sort str(VariableName)"
            },
            "name": "dd2Search"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        },
        "input_dd1": {
            "options": {
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "dd1"
            },
            "encoding": {
                "label": "primary[0]",
                "value": "primary[0]"
            },
            "dataSources": {
                "primary": "ds_dd1"
            },
            "title": "Event Name",
            "type": "input.dropdown",
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "statics": [],
                "label": ">primary | seriesByName(\"EventName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "value": ">primary | seriesByName(\"EventName\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            }
        },
        "input_dd2": {
            "options": {
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "dd2"
            },
            "encoding": {
                "label": "primary[0]",
                "value": "primary[0]"
            },
            "dataSources": {
                "primary": "ds_dd2"
            },
            "title": "Variable(s)",
            "type": "input.multiselect",
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "statics": [],
                "label": ">primary | seriesByName(\"VariableName\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "value": ">primary | seriesByName(\"VariableName\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            }
        }
    },
    "layout": {
        "type": "grid",
        "options": {
            "width": 1440,
            "height": 960
        },
        "structure": [
            {
                "item": "viz_Visualization",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 1440,
                    "h": 653
                }
            }
        ],
        "globalInputs": [
            "input_global_trp",
            "input_dd1",
            "input_dd2"
        ]
    },
    "description": "",
    "title": "Test"
}

NewToSplunk1_1-1723729274283.png

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I may be wrong (please contradict me if I am), but, I think this may still be one of the (many?) deficiencies of Studio when compared to SimpleXML - let's hope this and the other deficiencies are resolved before Simple XML support is withdrawn!

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...