Dropdown and multiselect

Dropdowns and multiselects allow users to choose options from a dropdown menu. Use a dropdown to allow the user to only select 1 option, such as when the user only needs to view data for 1 item at a time. Use a multiselect to allow the user to select multiple options, such as when the user needs to compare data between multiple items, aggregate data from several items, or filter data by multiple criteria.

Each dropdown and multiselect is associated with a unique token. When a dashboard user selects an option from a dropdown or multiselect, the option's value is assigned to the associated token.

A dashboard with 2 dropdown inputs and 1 multiselect input.

You can populate dropdown and multiselect input options using static values or dynamically using search results. You can add up to 1,000 menu options.

Populating a dropdown or multiselect using only static values

  1. From the Add input dropdown, select Dropdown or Multiselect.

  2. In the Token name field, configure the name of the token associated with this input.

  3. By default under Menu configuration, new dropdowns and multiselects have preconfigured options: All, Item 1, and so on. Define the label/value pairs that you want for your input. The label is what displays to the dashboard user in the input. The value is what is passed to the token when the user selects an option in the input. Configure as many options as needed.

  4. Under Default selected values, select one of the following:

    1. Choose default: select the desired default value.

    2. First value: the first option under Menu configuration is the default selection.

    3. None: there is no default selection for the input. You may want to configure a default to ensure that any visualizations that depend on the input's token display upon the dashboard loading.

  5. Configure other options as needed. The following shows an example multiselect configuration that uses only static values:

  6. Click Save.

Populating a dropdown or multiselect using dynamic values

  1. From the Add input dropdown, select Dropdown or Multiselect.

  2. In the Token name field, configure the name of the token associated with this input.

  3. By default under Menu configuration, new dropdowns and multiselects have preconfigured options: All, Item 1, and so on. Under Data sources, click + Set up primary data source. Select an existing data source or create a new one. For a data source to populate the options for a dropdown or multiselect input, it must satisfy the following requirements:

    • Return a list of results

    • Provide at least 1 field of data to act as the menu option labels and values

  4. From the Dynamic menu label field dropdown, select the field to use as the label. The label is what displays to the dashboard user in the input.

  5. From the Dynamic menu value field dropdown, select the field to use as the value. The value is what is passed to the token when the user selects an option in the input.

  6. You may want to use a mix of static and dynamic values. Remove and configure any static menu options as needed. The following shows an example configuration that uses the Username field from the data source as the dynamic menu label and field, and also a static value, All:

  7. Under Default selected values, select one of the following:

    1. Choose default: select the desired default value.

    2. First value: the first option under Menu configuration is the default selection.

    3. None: there is no default selection for the input. You may want to configure a default to ensure that any visualizations that depend on the input's token display upon the dashboard loading.

  8. Configure other options as needed.

  9. Click Save.

Multiselect: clear default on selection

For multiselect inputs, you can configure clearDefaultOnSelection in the source code editor. This option controls the behavior for the default selection when the user selects a value from the multiselect input:

  • When clearDefaultOnSelection is set to true and the user selects a value from the multiselect input, the input clears the default selection and only the user-selected value is selected.

  • When clearDefaultOnSelection is set to false and the user selects a value from the multiselect input, the input retains the default selection and both the default and the user-selected value are selected.

Apply token filters to multiselect values

When creating searches that rely on the token associated with a multiselect input, applying token filters to correctly capture the token value is recommended. When a user selects multiple values from a multiselect input, the value is stored in the token by using commas and spaces to separate the selections. When a token value include spaces, this may break the Splunk Search Processing Language (SPL) query unless you use the token filter $token|s$, which wraps values in quotation marks and helps with token usage in SPL. When configuring a query that uses a multiselect input token, use the IN operator and format your query appropriately. The following shows an example query: 
index=_internal sourcetype IN ($ms2|s$) | table _time, user, sourcetype
See Token filters.

The following shows an example dashboard with 2 dropdown inputs:

  • Sourcetype Dropdown Input: this input is populated dynamic values from a search. It also has one static value, All. The token from this input is used to filter the data in the Internal Sourcetype Event Trends line chart.

  • User Group Dropdown Input: this input is populated by manually configured static values. The token from this input is used to filter the data in the Internal User Activity Trends line chart.

A dashboard with 2 dropdown inputs and 2 line charts.

Copy and paste the dashboard definition into your own dashboard to see the example: 
{
    "title": "Activity Monitor",
    "inputs": {
        "input_3dVEAO3K": {
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "label": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "statics": [
                    [
                        "All"
                    ],
                    [
                        "*"
                    ]
                ],
                "value": ">primary | seriesByName(\"sourcetype\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_search1"
            },
            "options": {
                "defaultValue": "*",
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "token": "sourcetype"
            },
            "title": "Sourcetype Dropdown Input",
            "type": "input.dropdown"
        },
        "input_X97EppXX": {
            "options": {
                "defaultValue": "*",
                "items": [
                    {
                        "label": "All",
                        "value": "*"
                    },
                    {
                        "label": "Administrators",
                        "value": "admin"
                    },
                    {
                        "label": "Splunkers",
                        "value": "splunk-system-user"
                    }
                ],
                "token": "usergroup"
            },
            "title": "User Group Dropdown Input",
            "type": "input.dropdown"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_dObiuubP": {
            "dataSources": {
                "primary": "ds_quzxE8AQ"
            },
            "description": "index=_internal user IN ($usergroup$) | timechart count by user",
            "title": "Internal User Activity Trends",
            "type": "splunk.line"
        },
        "viz_gMr0oNmO": {
            "dataSources": {
                "primary": "ds_2A3Efw25"
            },
            "description": "index=_internal _sourcetype IN ($sourcetype$) | timechart count by _sourcetype",
            "title": "Internal Sourcetype Event Trends",
            "type": "splunk.line"
        }
    },
    "dataSources": {
        "ds_2A3Efw25": {
            "name": "Sourcetype search",
            "options": {
                "query": "index=_internal _sourcetype IN ($sourcetype$)\n| timechart count by _sourcetype",
                "queryParameters": {
                    "earliest": "-60m@m",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_quzxE8AQ": {
            "name": "User search",
            "options": {
                "query": "index=_internal user IN ($usergroup$)\n| timechart count by user",
                "queryParameters": {
                    "earliest": "-60m@m",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_search1": {
            "name": "Search_1",
            "options": {
                "query": "index=_internal \n| stats count by sourcetype",
                "queryParameters": {
                    "earliest": "-60m@m",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_3dVEAO3K",
            "input_X97EppXX"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "structure": [
                    {
                        "item": "viz_gMr0oNmO",
                        "position": {
                            "h": 342,
                            "w": 1200,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_dObiuubP",
                        "position": {
                            "h": 349,
                            "w": 1200,
                            "x": 0,
                            "y": 342
                        },
                        "type": "block"
                    }
                ],
                "type": "grid"
            }
        },
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

Multiselect input example

The following shows an example dashboard with 2 multiselect inputs:

  • VPN User Multiselect Input: this input is populated by dynamic values from a search. It also has one static value, All. This input is also configured to clear the default selected value, All, when the user selects another value. The token from this input is used to filter the data in the VPN User Session Log table.

  • Country Multiselect Input: this input is populated by manually configured static values. This input is not configured to clear the default selected values, Australia and Canada, when the user selects another value. The token from this input is used to filter the data in the Number of VPN Connections by Country table.

A dashboard with 2 multiselect inputs and 2 visualizations: 1 table and 1 bar chart.

Note that the SPL queries used to populate the visualizations use the |s token filter to correctly handle the token values from the multiselect inputs, which include spaces. This allows the visualizations to display the data for multiple VPN users and multiple countries. The | where clause in the queries also include ("$token$"="*") to handle when the user selects All. For example, the following shows the | where clause for the data source for the VPN User Session Log table: | where Username IN ($username|s$) OR ("$username$"="*")

Copy and paste the dashboard definition into your own dashboard to see the example:

{
    "title": "Network Traffic",
    "description": "",
    "inputs": {
        "input_LhTTn0a3": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range Input",
            "type": "input.timerange"
        },
        "input_YYokVP1N": {
            "options": {
                "clearDefaultOnSelection": false,
                "defaultValue": [
                    "Australia",
                    "Canada"
                ],
                "items": [
                    {
                        "label": "All",
                        "value": "*"
                    },
                    {
                        "label": "Australia",
                        "value": "Australia"
                    },
                    {
                        "label": "Canada",
                        "value": "Canada"
                    },
                    {
                        "label": "Germany",
                        "value": "Germany"
                    },
                    {
                        "label": "Japan",
                        "value": "Japan"
                    }
                ],
                "token": "country"
            },
            "title": "Country Multiselect Input",
            "type": "input.multiselect"
        },
        "input_tEBL5Sza": {
            "context": {
                "formattedConfig": {
                    "number": {
                        "prefix": ""
                    }
                },
                "formattedStatics": ">statics | formatByType(formattedConfig)",
                "label": ">primary | seriesByName(\"Username\") | renameSeries(\"label\") | formatByType(formattedConfig)",
                "statics": [
                    [
                        "All"
                    ],
                    [
                        "*"
                    ]
                ],
                "value": ">primary | seriesByName(\"Username\") | renameSeries(\"value\") | formatByType(formattedConfig)"
            },
            "dataSources": {
                "primary": "ds_MEJWisq3"
            },
            "options": {
                "items": ">frame(label, value) | prepend(formattedStatics) | objects()",
                "selectFirstSearchResult": true,
                "token": "username"
            },
            "title": "VPN User Multiselect Input",
            "type": "input.multiselect"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        },
        "visualizations": {
            "global": {
                "showProgressBar": true
            },
            "splunk.table": {
                "context": {
                    "ResultRowBackgroundColorsEditorConfig": [
                        {
                            "match": "Allowed",
                            "value": "#008000"
                        },
                        {
                            "match": "Blocked",
                            "value": "#FF0000"
                        }
                    ],
                    "ResultRowColorsEditorConfig": [
                        "#3c444d"
                    ]
                },
                "options": {
                    "columnFormat": {
                        "Result": {
                            "align": "auto",
                            "data": "> table | seriesByName(\"Result\") | formatByType(ResultColumnFormatEditorConfig)",
                            "headerAlign": "auto",
                            "rowBackgroundColors": "> table | seriesByName(\"Result\") | matchValue(ResultRowBackgroundColorsEditorConfig)",
                            "rowColors": "> table | seriesByName('Result') | pick(ResultRowColorsEditorConfig)",
                            "textOverflow": "break-word"
                        }
                    },
                    "tableFormat": {
                        "rowBackgroundColors": "> table | seriesByIndex(0) | pick(tableAltRowBackgroundColorsByTheme)"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_5seQZ9KK": {
            "dataSources": {
                "primary": "ds_MByyyjcI"
            },
            "options": {
                "y2": "> primary | frameBySeriesNames('')"
            },
            "title": "Number of VPN Connections by Country",
            "type": "splunk.bar"
        },
        "viz_K9ZIBWXa": {
            "dataSources": {
                "primary": "ds_ag1xuk36"
            },
            "title": "VPN User Session Log",
            "type": "splunk.table"
        }
    },
    "dataSources": {
        "ds_MByyyjcI": {
            "name": "Country Connections",
            "options": {
                "query": "| makeresults count=100\n| eval _time = now() - random() % 3600\n| eval user = \"user\" + tostring(random() % 10 + 1)\n| eval vpn_server = case(random() % 3 == 0, \"VPN_US_East\", random() % 3 == 1, \"VPN_EU_West\", 1=1, \"VPN_ASIA_South\")\n| eval country = case(random() % 5 == 0, \"USA\", random() % 5 == 1, \"Canada\", random() % 5 == 2, \"Germany\", random() % 5 == 3, \"Japan\", 1=1, \"Australia\")\n| eval connection_status = if(random() % 5 == 0, \"disconnected\", \"connected\")\n| eval bytes_in = random() % 1000000 + 10000\n| eval bytes_out = random() % 500000 + 5000\n| stats count AS \"Number of Connections\" by country| where country IN ($country|s$) OR (\"$country$\"\n=\"*\")\n| rename country AS \"Country\""
            },
            "type": "ds.search"
        },
        "ds_MEJWisq3": {
            "name": "Base VPN user info",
            "options": {
                "query": "| makeresults count=8\n| streamstats count as row_num\n| eval Timestamp = case(\n    row_num=1, \"2025-10-30 11:00:10 UTC\",\n    row_num=2, \"2025-10-30 11:01:05 UTC\",\n    row_num=3, \"2025-10-30 11:02:30 UTC\",\n    row_num=4, \"2025-10-30 11:03:15 UTC\",\n    row_num=5, \"2025-10-30 11:04:00 UTC\",\n    row_num=6, \"2025-10-30 11:05:20 UTC\",\n    row_num=7, \"2025-10-30 11:06:10 UTC\",\n    row_num=8, \"2025-10-30 11:07:00 UTC\"\n)\n| eval Username = case(\n    row_num=1, \"Ahmed Khan\",\n    row_num=2, \"Carlos Garcia\",\n    row_num=3, \"Mei Lin\",\n    row_num=4, \"David Schmidt\",\n    row_num=5, \"Padma Sharma\",\n    row_num=6, \"Jane Williams\",\n    row_num=7, \"Sofia Rossi\",\n    row_num=8, \"Ken Tanaka\"\n)\n| eval Source_IP = case(\n    row_num=1, \"72.21.99.1\",\n    row_num=2, \"104.16.2.3\",\n    row_num=3, \"198.51.100.10\",\n    row_num=4, \"72.21.99.1\",\n    row_num=5, \"203.0.113.25\",\n    row_num=6, \"104.16.2.3\",\n    row_num=7, \"198.51.100.10\",\n    row_num=8, \"1.2.3.4\"\n)\n| eval VPN_Gateway = case(\n    row_num=1, \"vpn-us-east-01\",\n    row_num=2, \"vpn-us-west-02\",\n    row_num=3, \"vpn-us-east-01\",\n    row_num=4, \"vpn-us-east-01\",\n    row_num=5, \"vpn-us-west-02\",\n    row_num=6, \"vpn-us-west-02\",\n    row_num=7, \"vpn-us-east-01\",\n    row_num=8, \"vpn-us-east-01\"\n)\n| eval Connection_Duration_min = case(\n    row_num=1, 60,\n    row_num=2, 120,\n    row_num=3, 45,\n    row_num=4, 0,\n    row_num=5, 90,\n    row_num=6, 0,\n    row_num=7, 30,\n    row_num=8, 0\n)\n| eval Data_Transferred_MB = case(\n    row_num=1, 500,\n    row_num=2, 1200,\n    row_num=3, 300,\n    row_num=4, 0,\n    row_num=5, 800,\n    row_num=6, 0,\n    row_num=7, 200,\n    row_num=8, 0\n)\n| eval Authentication_Method = case(\n    row_num=1, \"MFA\",\n    row_num=2, \"MFA\",\n    row_num=3, \"MFA\",\n    row_num=4, \"Password\",\n    row_num=5, \"MFA\",\n    row_num=6, \"Password\",\n    row_num=7, \"MFA\",\n    row_num=8, \"Password\"\n)\n| eval Result = case(\n    row_num=1, \"Allowed\",\n    row_num=2, \"Allowed\",\n    row_num=3, \"Allowed\",\n    row_num=4, \"Blocked\",\n    row_num=5, \"Allowed\",\n    row_num=6, \"Blocked\",\n    row_num=7, \"Allowed\",\n    row_num=8, \"Blocked\"\n)"
            },
            "type": "ds.search"
        },
        "ds_ag1xuk36": {
            "name": "VPN chart",
            "options": {
                "extend": "ds_MEJWisq3",
                "query": "| where Username IN ($username|s$) OR (\"$username$\"=\"*\")\n| table Timestamp, Username, Source_IP, VPN_Gateway, Connection_Duration_min, Data_Transferred_MB, Result, Authentication_Method\n"
            },
            "type": "ds.chain"
        }
    },
    "layout": {
        "globalInputs": [
            "input_LhTTn0a3",
            "input_tEBL5Sza",
            "input_YYokVP1N"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_K9ZIBWXa",
                        "position": {
                            "h": 340,
                            "w": 1380,
                            "x": 20,
                            "y": 20
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_5seQZ9KK",
                        "position": {
                            "h": 300,
                            "w": 1370,
                            "x": 20,
                            "y": 380
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}