Splunk Search

How to clear dropdown on change?

zoebanning
Path Finder

Hello Splunk Community, 

I have created a dashboard with 3 dropdowns; Select System, Select Environment, Select Period (time). 
Note: each system has named their environments the same i.e. Production, UAT etc.

I seem to be having a problem when i have already selected all dropdowns and metrics load, then i change the System dropdown, the Environment dropdown seems to update but there is 1 duplicate (i.e. in pervious search I selected 'Production' environment and now I have 2 Production environments assuming one is for each system). 

Can someone assist me to figure out how to clear the environment dropdown when i change the system? I have tried to play around with the settings within the UI but no luck. 

Is there something i need to change in my source code? 


<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="CMDB_CI_Name" searchWhenChanged="true">
<label>Select IT Services</label>
<fieldForLabel>CMDB_CI_Name</fieldForLabel>
<fieldForValue>CMDB_CI_Name</fieldForValue>
<search>
<query>|inputlookup list.csv | fields CMDB_CI_Name | dedup CMDB_CI_Name</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="env" searchWhenChanged="true">
<label>Select Environment</label>
<change>
<set token="tokEnvironment">$label$</set>
</change>
<fieldForLabel>Env_Purpose</fieldForLabel>
<fieldForValue>Env_Infra</fieldForValue>
<search>
<query>|inputlookup list.csv | search CMDB_CI_Name=$CMDB_CI_Name$ | fields Env_Purpose, Env_Infra
| dedup Env_Purpose, Env_Infra</query>
</search>
</input>
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time Period</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>

0 Karma

zoebanning
Path Finder

Hi Giuseppe, 

I have just tried this out but i don't want an additional filter that users will need to select to refresh. Is there any other way that doesn't require an additional filter?

 

Thanks,

Zoe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

this is the only solution I found.

Ciao and happy splunking.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @zoebanning,

please try this approach to reset all tokens.

    <input type="radio" token="resetTokens" searchWhenChanged="true">
      <label></label>
      <choice value="reset">Reset Inputs</choice>
      <choice value="retain">Retain</choice>
      <default>retain</default>
      <change>
        <condition value="reset">
          <unset token="token1"></unset>
          <unset token="token2"></unset>
          <unset token="token3"></unset>
          <set token="resetTokens">retain</set>
        </condition>
      </change>
    </input>

add it to your inputs.

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...