Dashboards & Visualizations

Why am I getting the dynamic drop-down error "Search is waiting for input"?

matstap
Communicator

I have a dynamic dropdown which takes a token $parent$ as an input for its populating search. I get the $parent$ tag by grabbing the current user's role and using it to get the final parent value from a lookup table. When I run this search outside of the dashboard, I get one value. However, when the dashboard runs, the dynamic dropdown says: "Could not create search. Search is waiting for input."

What are some reasons for this? (Splunk version 6.6.3)

<form >
  <label>Dashboard</label>
 <search>
        <query>| rest /services/authentication/current-context/context 
    | where username !="splunk-system-user" 
    | fields roles 
    | mvexpand roles 
    | join type=inner roles 
        [| inputlookup role_parent.csv ]</query>
        <done>
          <set token="parent">$result.Parent$</set>
        </done>
      </search>
      <fieldset submitButton="true" autoRun="false">
        <input type="multiselect" token="customer">
          <label>Customer</label>
          <delimiter> </delimiter>
          <fieldForLabel>Customer</fieldForLabel>
          <fieldForValue>Customer</fieldForValue>
          <search>
            <query>| inputlookup customers.csv where Parent=$parent$ </query>
          </search>
        </input>
0 Karma
1 Solution

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

View solution in original post

Vijeta
Influencer

There should be a | before “where” in your inputlookup query for your multi select customer input

0 Karma

HiroshiSatoh
Champion

I think that you can do it drop down so that the search will be executed.

| inputlookup customers.csv where [※sub search]

※ sub search

| rest /services/authentication/current-context/context 
     | where username !="splunk-system-user" 
     | fields roles 
     | mvexpand roles 
     | join type=inner roles 
         [| inputlookup role_parent.csv ]
     | table Parent

matstap
Communicator

This worked for me. Thanks!

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...