Try this dashboard <form version="1.1" theme="light">
<label>Multi-select usecase</label>
<init>
<set token="show_usecase"></set>
</init>
<fieldset submitButton="false">
<input type="multiselect" token="usecase" depends="$show_usecase$">
<label>Select Use Case</label>
<choice value="All">All</choice>
<default>All</default>
<search>
<query>| makeresults
| eval use_case_title=split("NRC1: High Severity IDS Alert,NRC2: New Malware Detection,NRC3: Splunk Health Check Failed,NRC4: Too Many Failed Logins per Device",",")
| mvexpand use_case_title
| sort use_case_title</query>
</search>
<fieldForLabel>use_case_title</fieldForLabel>
<fieldForValue>use_case_title</fieldForValue>
<initialValue>*</initialValue>
<prefix>"(</prefix>
<suffix>)"</suffix>
<valuePrefix>\"</valuePrefix>
<valueSuffix>\"</valueSuffix>
<delimiter>,</delimiter>
<change>
<eval token="form.usecase">case(mvcount('form.usecase')=0,"All",mvcount('form.usecase')>1 AND mvfind('form.usecase',"All")>0,"All",mvcount('form.usecase')>1 AND mvfind('form.usecase',"All")=0,mvfilter('form.usecase'!="All"),1==1,'form.usecase')</eval>
<eval token="usecase_choice">if('form.usecase'=="All","(\"*\")",'usecase')</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Report Results</title>
<table>
<search id="dynamic_report_search">
<query>
| makeresults
| fields - _time
| eval usecase_choice=$usecase_choice$
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">50</option>
</table>
</panel>
</row>
</form> Obviously, I have tweaked the searched to dummy up the data. Assuming this basic dashboard works, (as it does in my environment), then I suspect there is something else going on in your dashboard which you haven't shown e.g. your actual spl and my best guess is that there are other searches and tokens being changed which is affecting how the dashboard operates.
... View more