Splunk Search

Why does Dropdown retain entries from old query result?

jonvijay1993
Explorer

I have a query for for my dropdown with tokens inserted here and there and whenever the values on those tokens change my query runs to populate the dropdown.

But the problem is that sometimes the new values and old values are displayed together and I don't want that.

And worse is, the old value remains selected sometimes. I have to manually select my new entry. I have SelectFirstValue to true.

 

 

Labels (4)
0 Karma

jonvijay1993
Explorer

Do you know how I can set the dropdown to the first result in the query, like if the query returns a list of strings, how do I get the first element and set it to the form.token?

 

<unset token="form.project_name"></unset>
<set token="form.project_name">$form.result blah blah$</set>

 

btw the unset method worked, my old results are gone

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since you are trying to set the value of the token, there is no need to also unset it.

<eval token="form.project_name">$results.label</eval>

or whatever the field you are using for the label is called

0 Karma

jonvijay1993
Explorer

Ok I shall try this, thank you! I thought splunk was able to handle this by default, but solutions are also good!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try adding a done handler to the search that populates to dropdown which unsets the token.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...