Ah okay. I have other inputs that also need to be selected. So what I did was added the Submit button back but enabled "search on change" for my multiselect input. That seems to be doing the job. Just need to test some more. ... View more

@ITWhisperer - interesting thing to note. When I added the "Submit" button to your dashboard it behaved in the same manner as my developed dashboard. I went to my dashboard and changed the Submit button to false and set the Search on Changed = true for my inputs. The multiselect functionality now works when I select a value other than All. Can you test in your environment and see if you get the same results? ... View more

I tried your dashboard XML and it does indeed work. I am stumped...  Here is the XML for the usecase input as well as the bunit input which the use case input uses in its dynamic query. When the bunit is changed it clears out the form.usecase and usecase tokens which shouldn't impact the remove "All" eval token functionality. The usecase multiselect is getting populated with the correct values based on the bunit selected. <input type="dropdown" token="bunit" depends="$show_bunit$"> <label>Select Functional Area</label> <search> <query>| rest /services/authentication/current-context splunk_server=local | table roles | mvexpand roles | eval label=case(match(roles,"grid"),"GRID",match(roles,"gstn"),"GSTN",match(roles,"it"),"IT",match(roles,"psec"),"PSEC",match(roles,"admin|cso|csi"),"GRID|GSTN|IT|PSEC|All") | makemv delim="|" label | mvexpand label | eval value=if(label=="All","*",label) | stats count by label value | fields - count </query> <earliest>-24h</earliest> </search> <fieldForLabel>label</fieldForLabel> <fieldForValue>value</fieldForValue> <selectFirstChoice>true</selectFirstChoice> <change> <unset token="form.usecase"></unset> <unset token="usecase"></unset> </change> </input> <input type="multiselect" token="usecase" depends="$show_usecase$"> <label>Select Use Case</label> <choice value="All">All</choice> <default>All</default> <search> <query>index=ame_$bunit$ NOT index=ame_default sourcetype="ame-initial-entry" earliest=1 | rex field=event.event_title "^(?&lt;use_case_number&gt;[^\:\-]+)(\:|\-)" | lookup use_case_asset_field_lookup.csv use_case_number | stats count by use_case_title | fields - count | sort use_case_title</query> </search> <fieldForLabel>use_case_title</fieldForLabel> <fieldForValue>use_case_title</fieldForValue> <initialValue>*</initialValue> <prefix>"(</prefix> <suffix>)"</suffix> <valuePrefix>\"</valuePrefix> <valueSuffix>\"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="form.usecase">case(mvcount('form.usecase')=0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")&gt;0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")=0,mvfilter('form.usecase'!="All"),1==1,'form.usecase')</eval> <eval token="usecase_choice">if('form.usecase'=="All","(\"*\")",'usecase')</eval> </change> </input>   ... View more

Here is the XML section of my multiselect input: <input type="multiselect" token="usecase" depends="$show_usecase$"> <label>Select Use Case</label> <choice value="All">All</choice> <default>All</default> <search> <query>my spl here | stats count by use_case_title | fields - count | sort use_case_title</query> </search> <fieldForLabel>use_case_title</fieldForLabel> <fieldForValue>use_case_title</fieldForValue> <initialValue>*</initialValue> <prefix>"(</prefix> <suffix>)"</suffix> <valuePrefix>\"</valuePrefix> <valueSuffix>\"</valueSuffix> <delimiter>,</delimiter> <change> <eval token="form.usecase">case(mvcount('form.usecase')=0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")&gt;0,"All",mvcount('form.usecase')&gt;1 AND mvfind('form.usecase',"All")=0,mvfilter('form.usecase'!="All"),1==1,'form.usecase')</eval> <eval token="usecase_choice">if('form.usecase'=="All","(\"*\")",'usecase')</eval> </change> </input>   I have updated my panel search to use the token "usecase_choice" as directed. <row> <panel> <title>Report Results</title> <table> <search id="dynamic_report_search"> <query> | savedsearch "$report_name$" functional_area="$bunit$" usecase=$usecase_choice$ </query> <earliest>$time_range.earliest$</earliest> <latest>$time_range.latest$</latest> </search> <option name="count">50</option> </table> </panel> </row> When the dashboard comes up the default in the input is "All" but when I click on any of the other selections it quickly "flashes" like its adding the selection to the multiselect input and then just reverts back to "All"   ... View more

It's my understanding that <change> is not available for the multiselect input. https://docs.splunk.com/Documentation/Splunk/8.1.4/Viz/PanelreferenceforSimplifiedXML?_gl=1*1rio3cu*_gcl_au*MTg5MjAwNjgzOC4xNzc0OTg1MTIy*FPAU*MTg5MjAwNjgzOC4xNzc0OTg1MTIy*_ga*MzcxNzI3NjAwLjE3NzQ5ODUxMjI.*_ga_5EPM2P39FV*czE3NzYxODExOTQkbzExJGcxJHQxNzc2MTgyMTA5JGo2MCRsMCRoNjY4MTE4Njc.*_fplc*ek1XZHJ6U0NZa041blRiRktXYTdvJTJCemtaeTRucUlHSWRjUyUyRm5HQmtYdmF5cDNtbHIwOEtBd3BGeUFrZSUyRnBGUExMTlpOTCUyRmdxR0toaDBzbGpnSSUyRno0UTZoc21uR0FaSE5ETEY3MDVwaFp6cThlTU44UDlZNk9INW1OVDNoZyUzRCUzRA..#input_.28form.29 I've tried the XML solution recommended and it is not working in my Splunk 9.4x environment. ... View more