Sorry for the delay martin. The issue is the values passed via Content-Type in different browsers are not fully supported. I have raised a case with splunk - SPL-103335. As a workaround, splunk has advised to make the changes in splunk.js and splunk.min.js to allow different Content-type, which we are testing now.
In the Activity view, click the "search-string-link" to view the results of that job without running the search again. See if that yields results that fit to the results expected by the dropdown.
That looks okay. You say "doesn't work", doesn't work how? No values in the dropdown? No successful filtering in the panels below?
When you open the form, does a corresponding job appear in the Activity view linked to in the top right corner?
<input type="dropdown" token="field1" searchWhenChanged="false"> <choice value="*">All</choice> <search> <query>|rest splunk_server=local /services/authentication/current-context | table username,roles | mvexpand roles|search roles="roles*" | eval SPID = mvindex(split(roles,"-"),1) | dedup SPID | table SPID</query> <earliest>0</earliest> </search> <fieldForLabel>SPID</fieldForLabel> <fieldForValue>SPID</fieldForValue> <default>*</default> </input>
Thanks Martin. This works in a standalone splunk instance and when I integrate with SSO via Apache proxy, the above doesn't work in the form. However, if I run the same search in the 'search bar' of the search app. it shows the roles. Am I missing anything?