Dropdown and multiselect

Dropdown and multiselect inputs assign selected options to unique tokens, enabling dynamic data filtering and comparison in dashboards.

Dropdown and multiselect inputs allow users to choose options from a dropdown menu. Use a dropdown input to allow the user to only select one option, such as when the user only needs to view data for one item at a time. Use a multiselect input to allow the user to select multiple options, such as when the user needs to compare data between multiple items, aggregate data from several items, or filter data by multiple criteria.

Each dropdown and multiselect is associated with a unique token. When a dashboard user selects an option from a dropdown or multiselect, the option's value is assigned to the associated token.

A dashboard with 2 dropdown inputs and 1 multiselect input.

You can populate dropdown and multiselect input options using static values or dynamically using search results. You can add up to 1,000 menu options.

Populating a dropdown or multiselect using only static values

  1. From the Add input dropdown, select Dropdown or Multiselect.

  2. In the Token name field, configure the name of the token associated with this input.

  3. By default under Menu configuration, new dropdowns and multiselects have preconfigured options: All, Item 1, and so on. Define the label/value pairs for your input. The label is what displays to the dashboard user in the input. The value is what is passed to the token when the user selects an option in the input. Configure as many options as needed.

  4. Under Default selected values, select one of the following:

    • Choose default: select the desired default value.

    • First value: the first option under Menu configuration is the default selection.

    • None: there is no default selection for the input. You may want to configure a default to ensure that any visualizations that depend on the input's token display upon the dashboard loading.

  5. If desired, under Cascading input, activate Dynamically reset to default selected value. If activated, the input resets to its default value when a token in its data source changes. For example, if the input data source is index=_internal user=$name$ | stats count by sourcetype and $name$ changes, the input selection reverts to the input default value. This feature helps avoid displaying stale token values and "no results" errors.

  6. Configure other options as needed. The following shows an example multiselect configuration that uses only static values:

    Configuration for a multiselect input that allows the user to select static values.

  7. Click Save.

Populating a dropdown or multiselect using dynamic values

  1. From the Add input dropdown, select Dropdown or Multiselect.

  2. In the Token name field, configure the name of the token associated with this input.

  3. By default under Menu configuration, new dropdowns and multiselects have preconfigured options: All, Item 1, and so on. Under Data sources, click + Set up primary data source. Select an existing data source or create a new one. For a data source to populate the options for a dropdown or multiselect input, it must satisfy the following requirements:

    • Return a list of results

    • Provide at least 1 field of data to act as the menu option labels and values

  4. From the Dynamic menu label field dropdown, select the field to use as the label. The label is what displays to the dashboard user in the input.

  5. From the Dynamic menu value field dropdown, select the field to use as the value. The value is what is passed to the token when the user selects an option in the input.

  6. You may want to use a mix of static and dynamic values. Remove and configure any static menu options as needed.

  7. Under Selected value, configure the following:

    • Default selected values, select one of the following:

      • Choose default: select the desired default value.

      • First value: the first option under Menu configuration is the default selection.

      • None: there is no default selection for the input. You may want to configure a default to ensure that any visualizations that depend on the input's token display upon the dashboard loading.

    • If desired, under Cascading input, activate Dynamically reset to default selected value. If activated, the input resets to its default value when a token in its data source changes. For example, if the input data source is index=_internal user=$name$ | stats count by sourcetype and $name$ changes, the input selection reverts to the input default value. This feature helps avoid displaying stale token values and no results errors.

  8. Configure other options as needed. The following shows an example configuration that uses the Username field from the data source as the dynamic menu label and field, and also a static value, All, with Dynamically reset to default selected value activated:

  9. Click Save.

Multiselect: clear default on selection

For multiselect inputs, you can configure clearDefaultOnSelection in the source code editor. This option controls the behavior for the default selection when the user selects a value from the multiselect input:

  • When clearDefaultOnSelection is set to true and the user selects a value from the multiselect input, the input clears the default selection and only the user-selected value is selected.

  • When clearDefaultOnSelection is set to false and the user selects a value from the multiselect input, the input retains the default selection and both the default and the user-selected value are selected.

Apply token filters to multiselect values

When creating searches that rely on the token associated with a multiselect input, applying token filters to correctly capture the token value is best practice. When a user selects multiple values from a multiselect input, the value is stored in the token by using commas and spaces to separate the selections. When a token value include spaces, this may break the Splunk Search Processing Language (SPL) query unless you use the token filter $token|s$, which wraps values in quotation marks and helps with token usage in SPL. When configuring a query that uses a multiselect input token, use the IN operator and format your query appropriately. The following shows an example query:
CODE 
index=_internal sourcetype IN ($ms2|s$) | table _time, user, sourcetype
See Token filters.

The following shows an example dashboard with 2 dropdown inputs:

  • Sourcetype Dropdown Input: this input is populated with dynamic values from a search. It also has one static value, All. The token from this input is used to filter the data in the Internal Sourcetype Event Trends line chart.

  • User Group Dropdown Input: this input is populated by manually configured static values. The token from this input is used to filter the data in the Internal User Activity Trends line chart.

A dashboard with 2 dropdown inputs and 2 line charts.

Copy and paste the dashboard definition into your own dashboard to see the example:
JSON 
{
    "title": "Activity Monitor",
    "inputs": {
        "input_3dVEAO3K": {
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "label": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "statics": [
                    [
                        "All"
                    ],
                    [
                        "*"
                    ]
                ],
                "value": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_search1"
            },
            "options": {
                "defaultValue": "*",
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "sourcetype"
            },
            "title": "Sourcetype Dropdown Input",
            "type": "input.dropdown"
        },
        "input_X97EppXX": {
            "options": {
                "defaultValue": "*",
                "items": [
                    {
                        "label": "All",
                        "value": "*"
                    },
                    {
                        "label": "Administrators",
                        "value": "admin"
                    },
                    {
                        "label": "Splunkers",
                        "value": "splunk-system-user"
                    }
                ],
                "token": "usergroup"
            },
            "title": "User Group Dropdown Input",
            "type": "input.dropdown"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_dObiuubP": {
            "dataSources": {
                "primary": "ds_quzxE8AQ"
            },
            "description": "index=_internal user IN ($usergroup$) | timechart count by user",
            "title": "Internal User Activity Trends",
            "type": "splunk.line"
        },
        "viz_gMr0oNmO": {
            "dataSources": {
                "primary": "ds_2A3Efw25"
            },
            "description": "index=_internal _sourcetype IN ($sourcetype$) | timechart count by _sourcetype",
            "title": "Internal Sourcetype Event Trends",
            "type": "splunk.line"
        }
    },
    "dataSources": {
        "ds_2A3Efw25": {
            "name": "Sourcetype search",
            "options": {
                "query": "index=_internal _sourcetype IN ($sourcetype$)\n| timechart count by _sourcetype",
                "queryParameters": {
                    "earliest": "-60m@m",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_quzxE8AQ": {
            "name": "User search",
            "options": {
                "query": "index=_internal user IN ($usergroup$)\n| timechart count by user",
                "queryParameters": {
                    "earliest": "-60m@m",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_search1": {
            "name": "Search_1",
            "options": {
                "query": "index=_internal \n| stats count by sourcetype",
                "queryParameters": {
                    "earliest": "-60m@m",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_3dVEAO3K",
            "input_X97EppXX"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "structure": [
                    {
                        "item": "viz_gMr0oNmO",
                        "position": {
                            "h": 342,
                            "w": 1200,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_dObiuubP",
                        "position": {
                            "h": 349,
                            "w": 1200,
                            "x": 0,
                            "y": 342
                        },
                        "type": "block"
                    }
                ],
                "type": "grid"
            }
        },
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

Example with cascading dropdown and multiselect input

The following shows an example dashboard with 1 dropdown and 2 multiselect inputs:

  • Department Input: this dropdown sets the $dept_tok$ token and is populated by dynamic values from a search. It also has one static value, All.

  • VPN User Multiselect Input:

    • Sets the $username$ token, which is used to filter the data in the VPN User Session Log table.

    • Populated by dynamic values from a search that is filtered by the $dept_tok$ token set by Department Input

    • Default selected value is set to None, meaning that by default, the token is not set.

    • Dynamically reset to default selected value is activated for this input. When the value of $dept_token$ changes, this input resets to its default value, none.

    • The VPN User Sessions Log table is hidden when data is unavailable (when $username$ has no value). Therefore, when the user selects a new value from Department Input, the table is hidden until the user selects a new value from VPN User Multiselect Input.

  • Country Multiselect Input: this input is populated by manually configured static values. This input is not configured to clear the default selected values, Australia and Canada, when the user selects another value. The token from this input is used to filter the data in the Number of VPN Connections by Country chart.

A dashboard with 2 multiselect inputs and 2 visualizations: 1 table and 1 bar chart.

Note that the SPL queries used to populate the visualizations use the |s token filter to correctly handle the token values from the multiselect inputs, which include spaces. This allows the visualizations to display the data for multiple VPN users and multiple countries. The | where clause in the queries also include ("$token$"="*") to handle when the user selects All. For example, the following shows the | where clause for the data source for the VPN User Session Log table: | where Username IN ($username|s$) OR ("$username$"="*")

Copy and paste the dashboard definition into your own dashboard to see the example:

JSON 
{
    "title": "Network Traffic",
    "description": "",
    "inputs": {
        "input_IFxbRjul": {
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "label": ">primary | seriesByName(\"Department\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "statics": [
                    [
                        "All"
                    ],
                    [
                        "*"
                    ]
                ],
                "value": ">primary | seriesByName(\"Department\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_MEJWisq3"
            },
            "options": {
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "selectFirstSearchResult": true,
                "token": "dept_tok"
            },
            "title": "Department Input",
            "type": "input.dropdown"
        },
        "input_LhTTn0a3": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range Input",
            "type": "input.timerange"
        },
        "input_YYokVP1N": {
            "options": {
                "clearDefaultOnSelection": false,
                "defaultValue": [
                    "Australia",
                    "Canada"
                ],
                "items": [
                    {
                        "label": "All",
                        "value": "*"
                    },
                    {
                        "label": "Australia",
                        "value": "Australia"
                    },
                    {
                        "label": "Canada",
                        "value": "Canada"
                    },
                    {
                        "label": "Germany",
                        "value": "Germany"
                    },
                    {
                        "label": "Japan",
                        "value": "Japan"
                    }
                ],
                "token": "country"
            },
            "title": "Country Multiselect Input",
            "type": "input.multiselect"
        },
        "input_tEBL5Sza": {
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "label": ">primary | seriesByName(\"Username\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "statics": [],
                "value": ">primary | seriesByName(\"Username\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_wPi1joIP"
            },
            "options": {
                "isCascadingInput": true,
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "username"
            },
            "title": "VPN User Multiselect Input",
            "type": "input.multiselect"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        },
        "visualizations": {
            "global": {
                "showProgressBar": true
            },
            "splunk.table": {
                "context": {
                    "ResultRowBackgroundColorsEditorConfig": [
                        {
                            "match": "Allowed",
                            "value": "#008000"
                        },
                        {
                            "match": "Blocked",
                            "value": "#FF0000"
                        }
                    ],
                    "ResultRowColorsEditorConfig": [
                        "#3c444d"
                    ]
                },
                "options": {
                    "columnFormat": {
                        "Result": {
                            "align": "auto",
                            "data": "> table | seriesByName(\"Result\") | formatByType(ResultColumnFormatEditorConfig)",
                            "headerAlign": "auto",
                            "rowBackgroundColors": "> table | seriesByName(\"Result\") | matchValue(ResultRowBackgroundColorsEditorConfig)",
                            "rowColors": "> table | seriesByName('Result') | pick(ResultRowColorsEditorConfig)",
                            "textOverflow": "break-word"
                        }
                    },
                    "tableFormat": {
                        "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByTheme)"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_5seQZ9KK": {
            "dataSources": {
                "primary": "ds_MByyyjcI"
            },
            "options": {
                "y2": "> primary | frameBySeriesNames('')"
            },
            "title": "Number of VPN Connections by Country",
            "type": "splunk.bar"
        },
        "viz_K9ZIBWXa": {
            "containerOptions": {
                "visibility": {
                    "hideWhenNoData": true
                }
            },
            "dataSources": {
                "primary": "ds_ag1xuk36"
            },
            "title": "VPN User Session Log",
            "type": "splunk.table"
        }
    },
    "dataSources": {
        "ds_MByyyjcI": {
            "name": "Country Connections",
            "options": {
                "query": "| makeresults count=100\n| eval _time = now() - random() % 3600\n| eval user = \"user\" + tostring(random() % 10 + 1)\n| eval vpn_server = case(random() % 3 == 0, \"VPN_US_East\", random() % 3 == 1, \"VPN_EU_West\", 1=1, \"VPN_ASIA_South\")\n| eval country = case(random() % 5 == 0, \"USA\", random() % 5 == 1, \"Canada\", random() % 5 == 2, \"Germany\", random() % 5 == 3, \"Japan\", 1=1, \"Australia\")\n| eval connection_status = if(random() % 5 == 0, \"disconnected\", \"connected\")\n| eval bytes_in = random() % 1000000 + 10000\n| eval bytes_out = random() % 500000 + 5000\n| stats count AS \"Number of Connections\" by country| where country IN ($country|s$) OR (\"$country$\"\n=\"*\")\n| rename country AS \"Country\""
            },
            "type": "ds.search"
        },
        "ds_MEJWisq3": {
            "name": "Base VPN user info",
            "options": {
                "query": "| makeresults count=8\n| streamstats count as row_num\n| eval Timestamp = case(\n    row_num=1, \"2025-10-30 11:00:10 UTC\",\n    row_num=2, \"2025-10-30 11:01:05 UTC\",\n    row_num=3, \"2025-10-30 11:02:30 UTC\",\n    row_num=4, \"2025-10-30 11:03:15 UTC\",\n    row_num=5, \"2025-10-30 11:04:00 UTC\",\n    row_num=6, \"2025-10-30 11:05:20 UTC\",\n    row_num=7, \"2025-10-30 11:06:10 UTC\",\n    row_num=8, \"2025-10-30 11:07:00 UTC\"\n)\n| eval Username = case(\n    row_num=1, \"Ahmed Khan\",\n    row_num=2, \"Carlos Garcia\",\n    row_num=3, \"Mei Lin\",\n    row_num=4, \"David Schmidt\",\n    row_num=5, \"Padma Sharma\",\n    row_num=6, \"Jane Williams\",\n    row_num=7, \"Sofia Rossi\",\n    row_num=8, \"Ken Tanaka\"\n)\n| eval Source_IP = case(\n    row_num=1, \"72.21.99.1\",\n    row_num=2, \"104.16.2.3\",\n    row_num=3, \"198.51.100.10\",\n    row_num=4, \"72.21.99.1\",\n    row_num=5, \"203.0.113.25\",\n    row_num=6, \"104.16.2.3\",\n    row_num=7, \"198.51.100.10\",\n    row_num=8, \"1.2.3.4\"\n)\n| eval Department = case(\n    row_num=1, \"HR\",\n    row_num=2, \"IT\",\n    row_num=3, \"Finance\",\n    row_num=4, \"Engineering\",\n    row_num=5, \"HR\",\n    row_num=6, \"IT\",\n    row_num=7, \"Marketing\",\n    row_num=8, \"Engineering\"\n)\n| eval Connection_Duration_min = case(\n    row_num=1, 60,\n    row_num=2, 120,\n    row_num=3, 45,\n    row_num=4, 0,\n    row_num=5, 90,\n    row_num=6, 0,\n    row_num=7, 30,\n    row_num=8, 0\n)\n| eval Data_Transferred_MB = case(\n    row_num=1, 500,\n    row_num=2, 1200,\n    row_num=3, 300,\n    row_num=4, 0,\n    row_num=5, 800,\n    row_num=6, 0,\n    row_num=7, 200,\n    row_num=8, 0\n)\n| eval Authentication_Method = case(\n    row_num=1, \"MFA\",\n    row_num=2, \"MFA\",\n    row_num=3, \"MFA\",\n    row_num=4, \"Password\",\n    row_num=5, \"MFA\",\n    row_num=6, \"Password\",\n    row_num=7, \"MFA\",\n    row_num=8, \"Password\"\n)\n| eval Result = case(\n    row_num=1, \"Allowed\",\n    row_num=2, \"Allowed\",\n    row_num=3, \"Allowed\",\n    row_num=4, \"Blocked\",\n    row_num=5, \"Allowed\",\n    row_num=6, \"Blocked\",\n    row_num=7, \"Allowed\",\n    row_num=8, \"Blocked\"\n)"
            },
            "type": "ds.search"
        },
        "ds_ag1xuk36": {
            "name": "VPN chart",
            "options": {
                "extend": "ds_MEJWisq3",
                "query": "| where Username IN ($username|s$) OR (\"$username$\"=\"*\")\n| table Timestamp, Source_IP, Connection_Duration_min, Authentication_Method, Department, Username, Data_Transferred_MB, Result\n"
            },
            "type": "ds.chain"
        },
        "ds_wPi1joIP": {
            "name": "User input",
            "options": {
                "extend": "ds_MEJWisq3",
                "query": "| where Department IN ($dept_tok|s$) OR (\"$dept_tok$\"=\"*\")"
            },
            "type": "ds.chain"
        }
    },
    "layout": {
        "globalInputs": [
            "input_LhTTn0a3",
            "input_IFxbRjul",
            "input_tEBL5Sza",
            "input_YYokVP1N"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_K9ZIBWXa",
                        "position": {
                            "h": 340,
                            "w": 1380,
                            "x": 20,
                            "y": 20
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_5seQZ9KK",
                        "position": {
                            "h": 300,
                            "w": 1370,
                            "x": 20,
                            "y": 380
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}