Dashboards & Visualizations

Why is the base search not running at loading time and the optional filter input is not being displayed?


We have a dashboard with filters in a <fieldset> configured with autoRun=false, along with a submit button.

Some filters should only be displayed when the current user has a specific role. To find this, I run a base search calling the REST api and I set a token if the user has the role. This token is then used in the depends attribute of the <input>.

My problem is that the first time the dashboard is loaded, the base search is apparently not run and thus the optional filter input is not displayed (although the current user has the needed role). One needs to submit the filters at least once to see the optional filter appear.
How can I overcome this ?

Note : I don't want to use rejects instead of depends as the reverse problem will happen : users without the specific role will see the optional filter until they submit the search.

Here's a code with "power" used as the "trigger" role. The user you're using should inherit the power role in order to reproduce the problem :

<form hideFooter="true">
  <label>Splunk Test</label>
  <description>Splunk Test</description>

    <search id="detectPower">
     <query>| rest splunk_server=local /services/authentication/current-context | table roles 
            | search roles="power"
       <condition match="$job.resultCount$ > 0">
         <set token="powerUser">true</set>
         <unset token="powerUser"></unset>

  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="tokenTime" searchWhenChanged="false">

    <!-- Only for power users -->
    <input type="dropdown" token="tokenComponent" searchWhenChanged="false" depends="$powerUser$">
      <choice value="*">All components</choice>
        <query>index=_internal | fields component | dedup component | sort component</query>

      <html><p>powerUser: $powerUser$</p></html>
          <query>index=_internal component=$tokenComponent$
                 | stats count by log_level</query>

We're using Splunk 6.5.5.

0 Karma


@manur  I know this is an old question, but in case people come across this, here's a potential answer:

After the basesearch's </query> tag, try adding


Giving props where props are due:


If this reply helps you, an upvote would be appreciated.
0 Karma


One possible solution I have found is to enable searchWhenChanged="true" on one of the inputs.

At loading of this page, the data will be fetched and the base search will be run.

This contradicts a bit my requirements, though (data fetching only when the user clicks the submit button).

Is there another solution ? Couldn't some JavaScript force the launch of the base search at loading time instead ?

0 Karma


seems to work on my free 7.0.1 license...had to change the role search to admin since there are no users in the free version, but the input displayed as expected. And when i changed the role search to something else, the dropdown didn't display.

0 Karma


@maciep: I've just tried with a docker image of Splunk 7.0.2 and I kept having the same problem.
I created a user with only the "power" role, I opened the dashboard, I couldn't see the "Component" dropdown.
I clicked on Submit, the dropdown appeared.

0 Karma


ok, maybe i didn't test it fully enough. I don't think i ever left the dashboard and came back to it...just updated the xml, saved and refreshed.

I do see similar behavior on 6.5.2 as well

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...