Splunk® Dashboards App

Splunk Dashboards app (beta) for Enterprise and Cloud

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Use inputs and tokens to make dashboards dynamic

Use inputs to let dashboard users interact with dashboard data and visualizations using dropdown and multiselect menus, time range pickers, and more. The following is an example of a dashboard that uses many inputs.

A dashboard with many different types of inputs.

Expand this window to copy/paste the dashboard definition for this example into your own dashboard. 

{
	"visualizations": {
		"viz_W50bezIl": {
			"type": "viz.rectangle",
			"options": {
				"stroke": "$dd1$",
				"fill": "$dd1$"
			}
		},
		"viz_fxu4P8Ia": {
			"type": "viz.text",
			"options": {
				"content": "Inputs, inputs, inputs!",
				"fontWeight": "bold",
				"fontSize": 36
			}
		},
		"viz_KoO0pwdz": {
			"type": "viz.text",
			"options": {
				"content": "Select a color from the \"Color Dropdown\" input to change the background color of all blocks.\n",
				"fontSize": 14
			}
		},
		"viz_ua8rEoxM": {
			"type": "viz.text",
			"options": {
				"content": "In Edit mode, click on the dropdown input to see how the input name, token, and static values are specified in the Configuration panel. See how static menu items are defined. Add a new menu item for the color \"Green\" with the value \"#26AA92\".\n\nClick on the rectangle shape and look for the Fill Color and Border Color. You'll see their values are #A870EF, the token from the dropdown input!",
				"fontSize": 10
			}
		},
		"viz_JZynl9HI": {
			"type": "viz.rectangle",
			"options": {
				"stroke": "$dd1$",
				"fill": "$dd1$"
			}
		},
		"viz_barchart": {
			"type": "viz.bar",
			"options": {
				"backgroundColor": "transparent",
				"foregroundColor": "#FFFFFF",
				"seriesColors": [
					"#FFFFFF"
				]
			},
			"dataSources": {
				"primary": "ds_barchart"
			},
			"showLastUpdated": false,
			"title": "These sourcetypes were selected from the multi-select input",
			"description": ""
		},
		"viz_2PYEsPbj": {
			"type": "viz.text",
			"options": {
				"content": "The sourcetypes displayed in this bar chart are chosen from the multi-select input. Click on the input and open the \"Code\" view or view in source to see how to dynamically display values, powered by a search. You'll see that you'll need to add \"dataSources\" and \"encoding\" sections to your input.",
				"fontSize": 10
			}
		},
		"viz_PZiOx9UE": {
			"type": "viz.rectangle",
			"options": {
				"fill": "$dd1$",
				"stroke": "$dd1$"
			}
		},
		"viz_A3dlrAjm": {
			"type": "viz.rectangle",
			"options": {
				"stroke": "#31373e",
				"fillOpacity": 0.4,
				"strokeOpacity": 0.4
			}
		},
		"viz_sv": {
			"type": "viz.singlevalue",
			"options": {
				"backgroundColor": "transparent"
			},
			"dataSources": {
				"primary": "ds_sv"
			},
			"showLastUpdated": false,
			"title": "$text1$",
			"description": ""
		},
		"viz_LkyiBKXs": {
			"type": "viz.text",
			"options": {
				"content": "Change the value in the number input to see this value change. ",
				"fontSize": 14,
				"fontWeight": "bold"
			}
		},
		"viz_fNSVQrgY": {
			"type": "viz.text",
			"options": {
				"content": "Click on the number input to view its settings in the Configuration panel. Change the min, max, and step values and observe how the input behaves!",
				"fontSize": 10
			}
		},
		"viz_wNw4b9sq": {
			"type": "viz.text",
			"options": {
				"content": "Change the value in the text input to see the title change. ",
				"fontSize": 14,
				"fontWeight": "bold"
			}
		},
		"viz_sv4lBclf": {
			"type": "viz.text",
			"options": {
				"content": "Click on the text input to view its settings in the Configuration panel. Change the default value.",
				"fontSize": 10
			}
		},
		"viz_H0eBzMdz": {
			"type": "viz.rectangle",
			"options": {
				"fill": "$dd1$",
				"stroke": "$dd1$"
			}
		},
		"viz_ZvNbPNsn": {
			"type": "viz.text",
			"options": {
				"content": "Bonus tip! You can rearrange the display order of the inputs by clicking on an input, and then drag & drop.",
				"fontSize": 16,
				"fontWeight": "bold"
			}
		}
	},
	"dataSources": {
		"ds_ms": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal | stats count by sourcetype"
			},
			"name": "multiselect input"
		},
		"ds_barchart": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal sourcetype IN ($ms1$) \n|  stats count by sourcetype"
			},
			"name": "barchart"
		},
		"ds_sv": {
			"type": "ds.search",
			"options": {
				"query": "| makeresults \n| eval sv=$num1$"
			},
			"name": "singlevalue"
		}
	},
	"defaults": {
		"dataSources": {
			"ds.search": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		},
		"visualizations": {
			"global": {
				"showLastUpdated": true
			}
		}
	},
	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-60m@m,now"
			},
			"title": "Global Time Range"
		},
		"input_dropdown": {
			"options": {
				"items": [
					{
						"label": "Purple",
						"value": "#A870EF"
					},
					{
						"label": "Teal",
						"value": "#45D4BA"
					},
					{
						"label": "Blue",
						"value": "#4EB2D2"
					},
					{
						"label": "Pink",
						"value": "#F29BAC"
					},
					{
						"label": "Orange",
						"value": "#FDAF93"
					},
					{
						"label": "Yellow",
						"value": "#FFC34E"
					}
				],
				"defaultValue": "#45D4BA",
				"token": "dd1"
			},
			"title": "COLOR (Dropdown)",
			"type": "input.dropdown"
		},
		"input_multiselect": {
			"options": {
				"clearDefaultOnSelection": true,
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"defaultValue": "*",
				"token": "ms1"
			},
			"dataSources": {
				"primary": "ds_ms"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"title": "SOURCETYPE (Multi-select)",
			"type": "input.multiselect"
		},
		"input_2dQuKvMQ": {
			"options": {
				"defaultValue": "dashboards beta v0.9",
				"token": "text1"
			},
			"title": "Text Input",
			"type": "input.text"
		},
		"input_0QICmUXK": {
			"options": {
				"token": "num1",
				"min": 0,
				"max": 100,
				"step": 5,
				"defaultValue": 15
			},
			"title": "Number Input",
			"type": "input.number"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"width": 1000,
			"height": 500
		},
		"structure": [
			{
				"item": "viz_PZiOx9UE",
				"type": "block",
				"position": {
					"x": 0,
					"y": 350,
					"w": 1000,
					"h": 100
				}
			},
			{
				"item": "viz_W50bezIl",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 1000,
					"h": 100
				}
			},
			{
				"item": "viz_fxu4P8Ia",
				"type": "block",
				"position": {
					"x": 10,
					"y": 20,
					"w": 380,
					"h": 50
				}
			},
			{
				"item": "viz_KoO0pwdz",
				"type": "block",
				"position": {
					"x": 400,
					"y": -10,
					"w": 570,
					"h": 50
				}
			},
			{
				"item": "viz_ua8rEoxM",
				"type": "block",
				"position": {
					"x": 400,
					"y": 20,
					"w": 590,
					"h": 80
				}
			},
			{
				"item": "viz_JZynl9HI",
				"type": "block",
				"position": {
					"x": 0,
					"y": 110,
					"w": 1000,
					"h": 230
				}
			},
			{
				"item": "viz_barchart",
				"type": "block",
				"position": {
					"x": 0,
					"y": 140,
					"w": 1000,
					"h": 210
				}
			},
			{
				"item": "viz_2PYEsPbj",
				"type": "block",
				"position": {
					"x": 10,
					"y": 100,
					"w": 990,
					"h": 50
				}
			},
			{
				"item": "viz_A3dlrAjm",
				"type": "block",
				"position": {
					"x": 10,
					"y": 670,
					"w": 350,
					"h": 180
				}
			},
			{
				"item": "viz_sv",
				"type": "block",
				"position": {
					"x": 10,
					"y": 360,
					"w": 270,
					"h": 80
				}
			},
			{
				"item": "viz_LkyiBKXs",
				"type": "block",
				"position": {
					"x": 290,
					"y": 340,
					"w": 560,
					"h": 40
				}
			},
			{
				"item": "viz_fNSVQrgY",
				"type": "block",
				"position": {
					"x": 290,
					"y": 360,
					"w": 700,
					"h": 50
				}
			},
			{
				"item": "viz_wNw4b9sq",
				"type": "block",
				"position": {
					"x": 290,
					"y": 380,
					"w": 560,
					"h": 40
				}
			},
			{
				"item": "viz_sv4lBclf",
				"type": "block",
				"position": {
					"x": 290,
					"y": 400,
					"w": 540,
					"h": 50
				}
			},
			{
				"item": "viz_H0eBzMdz",
				"type": "block",
				"position": {
					"x": 0,
					"y": 460,
					"w": 1000,
					"h": 30
				}
			},
			{
				"item": "viz_ZvNbPNsn",
				"type": "block",
				"position": {
					"x": 10,
					"y": 450,
					"w": 850,
					"h": 40
				}
			}
		],
		"globalInputs": [
			"input_global_trp",
			"input_dropdown",
			"input_multiselect",
			"input_0QICmUXK",
			"input_2dQuKvMQ"
		]
	},
	"description": "",
	"title": "Dashboards Beta v0.9 Highlights"
}

Some inputs can be modified and formatted in some ways in the visual editor. Configurations not available in the visual editor must be completed in the source editor. To learn how to use the source editor, see How the dashboard definition is structured in the source editor.

Conversion from Simple XML to JSON dashboards

If you convert an existing Simple XML dashboard with form inputs to the Splunk Dashboards app (beta), inputs will also be converted with the following exceptions:

  • Linklist inputs will be converted to dropdown inputs. Linklist inputs will be deprecated in the new dashboard framework.
  • Checkbox inputs will convert to multiselect inputs, and radio inputs will convert to dropdown inputs.
  • The multiselect input currently only supports the comma (,) delimiter in SPL queries. To read more on using multiselect inputs, see: input.multiselect.
  • Inputs in the new framework support the setting for a default value, but not an initial value.

Adding and configuring inputs

You can add, delete, and modify some inputs to varying extents using the visual editor, but you must configure most dynamic options in the source editor. To add an input, click the Add Input icon (The Add Input icon.) and select the input you want to add.

An image of the Add Inputs drop down menu.

When you add inputs using the visual editor, their layout configuration is automatically generated in the dashboard definition. When you create an input in the source editor, you must add it in two places in the dashboard definition. You define the input stanza, with all of its options, in the inputs section. If you define the input ID, it must begin with input_. You must also list the unique ID of the input in the globalInupts area of the layout section. The order that the inputs are listed in the dashboard is the order they will be listed in the layout.

For example, in the code snippet below input_2 will be to the right of input_1. 

{
	"inputs": {
		"input_1": {
			"type": "input.timerange",
			"title": "Select Time",
			"options": {
				"defaultValue": "-5m, now",
				"token": "trp"
			}
		},
		"input_2": {
			"type": "input.dropdown",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"token": "dd1",
				"defaultValue": "*"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search1"
			},
			"title": "Select User"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {},
		"structure": [],
		"globalInputs": [
			"input_1",
			"input_2"
		]
	},
	"dataSources": {
		"search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by user",
				"queryParameters": {
					"latest": "$trp.latest$",
					"earliest": "$trp.earliest$"
				}
			},
			"name": "User"
		}
	},
	"visualizations": {},
	"description": "",
	"title": "Super Input Dash"
}


You define inputs by their type. For example, a dropdown input is of type input.dropdown. You can set properties for their title and define options that depend on the input type. For example, two common options are token and defaultValue.

The following input types are supported:

  • input.timerange

A version of this input is automatically added to every dashboard by default and is applied to all data sources with the exception of those of type ds.savedSearch. This input can be deleted or edited if you want to set search intervals for individual data sources or global defaults. You can also add your own custom time range picker. For more information, see input.timerange

  • input.dropdown
  • input.multiselect
  • input.text
  • input.number

Add a submit button

You can add a submit button for users to click on to refresh a dashboard after making input selections. You add this property, submitButton in the layout section of the dashboard definition as an option. The settings are the boolean values true and false. When set to true, a user must click a Submit button in order for the an input selection to take effect. If set to false, or if not specified at all, the dashboard will immediately refresh when a user makes a selection. The following layout example would create a Submit button for the user: 

"layout": {
        "globalInputs": [],
        "type": "absolute",
        "options": {
            "backgroundColor": "#C093F9",
            "backgroundImage":
                          {     "x": 0,                        
                                "y": 0,                       
                               "src": "splunk-enterprise-kvstore://5f6cc9810b19516995423ad1",                        
                                "sizeType": "contain"            
 }
            "submitButton": true,
            "width": 1198,
            "height": 898,
            "display": "auto-scale"
        },
        "structure": []
    },

Input configuration options available in the visual editor

You can add, delete, and move inputs along the top of the dashboard canvas using the visual editor. There are also limited configuration options available for some inputs.

The following table is a list of the configuration options available to you for each input in the UI. If a setting is not listed here, you must set it in the source editor.

name configuration option example image
Time range picker title, token, defaultValue Time range picker UI options.
Number title, token, defaultValue,min, max, step Number input UI options.
Text title, token, defaultValue Text input UI options.
Dropdown title, token, defaultValue

You can also set static label/value pairs for the input.

Dropdown input UI options.
Multiselect title, token, defaultValue

You can also set static label/value pairs for the input.

Multiselect input UI options.

All configuration options

The choices for the options field and the option settings available to you will vary depending on the input type. For certain inputs like dropdown and multiselect you can use static values, dynamic values, or a combination of both. The following is a table of settings, options, and option settings for inputs. Settings are not options, but are values set at the same level as the options field.

name setting or option description
token option Assign tokens values or options created by a connected data source query.
defaultValue option The default value of the input on dashboard load. This will remain the value until changed by the user.
items option Set static label/value pairs for users to select in input menus.
min option Set the minimum number a user can select for input.number.
max option Set the maximum number a user can select for input.number.
step option Set the interval for the up and down arrows when a user clicks them for input.number.
clearDefaultOnSelection option When set to false the defaultValue remains selected when a user selects other options for input.multiselect. The default is true.
type setting The type of input. For example input.multiselect, input.text.
title setting Title of the input that will be displayed in edit & view mode.

input.timerange

By default there is a global time range picker input that controls all data source time ranges on a dashboard. While it can be useful to control all data sources with one time range, you can also modify or delete the global time range picker, or create your own. To learn more about the global time range picker, see The global time range picker.

Adding a time range picker input allows users to chose time intervals to create tokens to use in searches.

The following options are available to use in the options field:

  • defaultValue
  • token

The following is an example of input.timerange:

A dashboard with a time range picker input.

Expand this window to copy/paste the dashboard definition into your own dashboard. 

{
	"visualizations": {},
	"dataSources": {
		"search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by user",
				"queryParameters": {
					"latest": "$trp.latest$",
					"earliest": "$trp.earliest$"
				}
			},
			"name": "User"
		}
	},
	"inputs": {
		"input_1": {
			"type": "input.timerange",
			"title": "Select Time",
			"options": {
				"defaultValue": "-5m, now",
				"token": "trp"
			}
		}
	},
	"layout": {
		"type": "absolute",
		"options": {},
		"structure": [],
		"globalInputs": [
			"input_1"
		]
	},
	"description": "",
	"title": "TRP Input Dash"
}

The global time range picker

By default, there is a global time range picker added to new dashboards that you use to determine the time ranges of all of the searches for the data sources in a dashboard not of type ds.savedSearch. Although the name, input.timerange is used like any time range input, this input is unique because it also adds settings in the defaults section of the dashboard definition.

If you want to use different time ranges for different data sources, you can modify or delete the default input, or create your own. To learn how to create your own time range picker, see input.timerange. To learn how to delete the global time range picker, see Delete the global time range picker.

The following screenshot shows the global time range picker.

A dashboard with a Time Range Picker input.

To see an example of a complete dashboard with the global time range picker and its defaults values You can expand the following dashboard definition:

Expand this window to copy/paste the dashboard definition into your own dashboard. 

{
	"visualizations": {
		"viz_ZgRiQCoQ": {
			"type": "viz.column",
			"options": {},
			"dataSources": {
				"primary": "ds_GHdtwfg5"
			}
		}
	},
	"dataSources": {
		"ds_GHdtwfg5": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n|  top 100 sourcetype"
			},
			"name": "Search_1"
		}
	},
	"defaults": {
		"dataSources": {
			"global": {
				"options": {
					"queryParameters": {
						"latest": "$global_time.latest$",
						"earliest": "$global_time.earliest$"
					}
				}
			}
		},
		"visualizations": {
			"global": {
				"showLastUpdated": true
			}
		}
	},
	"inputs": {
		"input_global_trp": {
			"type": "input.timerange",
			"options": {
				"token": "global_time",
				"defaultValue": "-24h@h,now"
			},
			"title": "Global Time Range"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {},
		"structure": [
			{
				"item": "viz_ZgRiQCoQ",
				"type": "block",
				"position": {
					"x": 0,
					"y": 0,
					"w": 300,
					"h": 300
				}
			}
		],
		"globalInputs": [
			"input_global_trp"
		]
	},
	"title": "Global time range picker",
	"description": ""
}

Delete the global time range picker

You can both delete and edit this input. To delete the input, do the following:

  1. In the visual editor, click the X in the corner of the input. This will remove the input from the visual editor, the dashboard definition, and the layout.
  2. Delete the time range tokens in the defaults section.
    Delete queryParameters and the related settings. 
    "defaults": {
	"dataSources": {
		"global": {
			"options": {
				"queryParameters": {
					"latest": "$global_time.latest$",
					"earliest": "$global_time.earliest$"
				}
			}
		}
	},


If you delete the input entirely in the source editor, remember to also remove it from the globalInputs section of the layout as well as the queryParameters and the related settings in the defaults section.

input.dropdown

Use this input to let users choose one option from a dropdown menu. Use multiselect inputs to let users make make multiple selections at once. You can populate dropdown inputs using either static values or create them dynamically using search results. You can add up to, and including, 1000 dropdown menu options.

When you want to create a static menu, you must define the key/value pairs: label and value. The label is what the user chooses from the menu and the value is what is passed to the token when selected.

The following options are available to use in the options field:

  • defaultValue
  • token
  • items

The following example contains three dropdowns. One is backed by static values, a second is backed dynamically by search results, and a third combines both static and dynamic values:

A dashboard with dropdown and multiselect inputs. Some have static options, some menus are populated by search results.

Expand this window to copy/paste the dashboard definition into your own dashboard. 

 {
	"visualizations": {
		"viz_aQmAj6jI": {
			"type": "viz.line",
			"options": {
				"chart.showMarkers": false,
				"backgroundColor": "#1A1C20"
			},
			"dataSources": {
				"primary": "ds_Tv9uyy7l"
			},
			"title": "Searched Backed Dropdown",
			"description": "Token Value: $dynamicInput$"
		},
		"viz_ZnktdC5e": {
			"type": "viz.line",
			"options": {
				"chart.showMarkers": false,
				"backgroundColor": "#1A1C20"
			},
			"dataSources": {
				"primary": "ds_VncJQ9Dh_ds_Tv9uyy7l"
			},
			"title": "Static Dropdown ",
			"description": "Token Value: $staticInput$"
		},
		"viz_mTotVhy1": {
			"type": "viz.line",
			"options": {
				"chart.showMarkers": false,
				"backgroundColor": "#1A1C20"
			},
			"dataSources": {
				"primary": "ds_UO5BLJcY_ds_VncJQ9Dh_ds_Tv9uyy7l"
			},
			"title": "Search & Static Backed Dropdown",
			"description": "Token Value: $comboInput$"
		}
	},
	"dataSources": {
		"search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by user",
				"queryParameters": {
					"latest": "now",
					"earliest": "-4h@m"
				}
			},
			"name": "Sourcetype Count"
		},
		"ds_Tv9uyy7l": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($dynamicInput$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-15m",
					"latest": "now"
				}
			},
			"name": "Dynamic Line"
		},
		"ds_VncJQ9Dh_ds_Tv9uyy7l": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($staticInput$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Static Line"
		},
		"ds_UO5BLJcY_ds_VncJQ9Dh_ds_Tv9uyy7l": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($comboInput$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Combo Line"
		}
	},
	"inputs": {
		"input_dynamic": {
			"type": "input.dropdown",
			"options": {
				"token": "dynamicInput",
				"defaultValue": "admin"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search1"
			},
			"title": "Search Backed Dropdown"
		},
		"input_static": {
			"type": "input.dropdown",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					},
					{
						"label": "admin",
						"value": "admin"
					},
					{
						"label": "Splunk System User",
						"value": "splunk-system-user"
					},
					{
						"label": "Nobody",
						"value": "nobody"
					}
				],
				"token": "staticInput",
				"defaultValue": "*"
			},
			"title": "Static Values Dropdown"
		},
		"input_combo": {
			"type": "input.dropdown",
			"options": {
				"items": [
					{
						"label": "All (Static Value 1)",
						"value": "*"
					},
					{
						"label": "Static Value 2",
						"value": "static-2"
					},
					{
						"label": "Static Value 3",
						"value": "static-3"
					}
				],
				"token": "comboInput",
				"defaultValue": "*"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search1"
			},
			"title": "Search & Static Dropdown"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"backgroundColor": "#111215",
			"width": 1440,
			"display": "auto-scale",
			"showTitleAndDescription": false,
			"height": 700
		},
		"structure": [
			{
				"item": "viz_aQmAj6jI",
				"type": "block",
				"position": {
					"x": 40,
					"y": 40,
					"w": 660,
					"h": 280
				}
			},
			{
				"item": "viz_ZnktdC5e",
				"type": "block",
				"position": {
					"x": 740,
					"y": 40,
					"w": 660,
					"h": 280
				}
			},
			{
				"item": "viz_mTotVhy1",
				"type": "block",
				"position": {
					"x": 40,
					"y": 340,
					"w": 1360,
					"h": 310
				}
			}
		],
		"globalInputs": [
			"input_dynamic",
			"input_static",
			"input_combo"
		]
	},
	"title": "Examples for dropdown Inputs"
}

input.multiselect

Use the multiselect input to let users to select multiple options from a dropdown menu. Use the dropdown input type to let users make a single selection. You can populate multiselect inputs using either static values or dynamically by using search results. You can add up to, and including, 1000 options to the multiselect menu.

The only supported multiselect input delimiter is the comma, so use the IN operator and format your queries appropriately, for example: index=_internal sourcetype IN ($ms2$) | table _time, user, sourcetype

The following options are available to use in the multiselect input options field:

  • defaultValue
  • token
  • items
  • clearDefaultOnSelection

When you add a multiselect input, the value set for defaultValue will automatically be selected, but will be deselected when you choose another option. If set you set clearDefaultOnSelection to false, however, the default value will remain selected.

In the following example, there are three multiselect inputs. One uses only static values, one that has a menu populated by search results, and a third input that combines both static and dynamic values.

A dashboard with three multiselect inputs.

Expand this window to copy/paste the dashboard definition into your own dashboard. 

<div class="samplecode">
<pre>
{
	"visualizations": {
		"viz_aQmAj6jI": {
			"type": "viz.line",
			"options": {
				"chart.showMarkers": false,
				"backgroundColor": "#1A1C20"
			},
			"dataSources": {
				"primary": "ds_Tv9uyy7l"
			},
			"title": "Searched Backed Dropdown",
			"description": "Token Value: $dynamicInput$"
		},
		"viz_ZnktdC5e": {
			"type": "viz.line",
			"options": {
				"chart.showMarkers": false,
				"backgroundColor": "#1A1C20"
			},
			"dataSources": {
				"primary": "ds_VncJQ9Dh_ds_Tv9uyy7l"
			},
			"title": "Static Dropdown ",
			"description": "Token Value: $staticInput$"
		},
		"viz_mTotVhy1": {
			"type": "viz.line",
			"options": {
				"chart.showMarkers": false,
				"backgroundColor": "#1A1C20"
			},
			"dataSources": {
				"primary": "ds_UO5BLJcY_ds_VncJQ9Dh_ds_Tv9uyy7l"
			},
			"title": "Search & Static Backed Dropdown",
			"description": "Token Value: $comboInput$"
		}
	},
	"dataSources": {
		"search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by user",
				"queryParameters": {
					"latest": "now",
					"earliest": "-24h@h"
				}
			},
			"name": "Sourcetype Count"
		},
		"ds_Tv9uyy7l": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($dynamicInput$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Dynamic Line"
		},
		"ds_VncJQ9Dh_ds_Tv9uyy7l": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($staticInput$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Static Line"
		},
		"ds_UO5BLJcY_ds_VncJQ9Dh_ds_Tv9uyy7l": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user IN ($comboInput$)\n| timechart count by user",
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				}
			},
			"name": "Combo Line"
		}
	},
	"inputs": {
		"dynamicInput": {
			"type": "input.multiselect",
			"options": {
				"token": "dynamicInput",
				"defaultValue": "admin",
                                "clearDefaultOnSelection" : "false"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search1"
			},
			"title": "Search Backed Dropdown"
		},
		"staticInput": {
			"type": "input.multiselect",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					},
					{
						"label": "admin",
						"value": "admin"
					},
					{
						"label": "Splunk System User",
						"value": "splunk-system-user"
					},
					{
						"label": "Nobody",
						"value": "nobody"
					}
				],
				"token": "staticInput",
				"defaultValue": "*"
			},
			"title": "Static Values Dropdown"
		},
		"comboInput": {
			"type": "input.multiselect",
			"options": {
				"items": [
					{
						"label": "All (Static Value 1)",
						"value": "*"
					},
					{
						"label": "Static Value 2",
						"value": "static-2"
					},
					{
						"label": "Static Value 3",
						"value": "static-3"
					}
				],
				"token": "comboInput",
				"defaultValue": "*"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search1"
			},
			"title": "Search & Static Dropdown"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"backgroundColor": "#111215",
			"width": 1440,
			"display": "auto-scale",
			"height": 700
		},
		"structure": [
			{
				"item": "viz_aQmAj6jI",
				"type": "block",
				"position": {
					"x": 40,
					"y": 40,
					"w": 660,
					"h": 280
				}
			},
			{
				"item": "viz_ZnktdC5e",
				"type": "block",
				"position": {
					"x": 740,
					"y": 40,
					"w": 660,
					"h": 280
				}
			},
			{
				"item": "viz_mTotVhy1",
				"type": "block",
				"position": {
					"x": 40,
					"y": 340,
					"w": 1360,
					"h": 310
				}
			}
		],
		"globalInputs": [
			"dynamicInput",
			"staticInput",
			"comboInput"
		]
	},
	"title": "Example — Multiselect Input"
}

input.text

Use text inputs to let dashboard users pass any number or sting to the input that defines a token that can be used throughout the dashboard.

The following options are available:

  • defaultValue
  • token

The following example uses tokens set by one text input to both determine the number of results returned and another to set the color of various visualization properties.

A dashboard with three multiselect inputs.

Expand this window to copy/paste the dashboard definition into your own dashboard. 

{
	"visualizations": {
		"viz_R8trLpwN": {
			"type": "viz.table",
			"options": {
				"rowNumbers": true,
				"backgroundColor": "transparent",
				"headerBackgroundColor": "$hex$",
				"rowTextColorOdd": "#ffffff",
				"rowTextColorEven": "#ffffff"
			},
			"dataSources": {
				"primary": "ds_BIdQZ95d"
			},
			"title": "Top $count$ Sourcetypes",
			"description": ""
		},
		"viz_mz81M1yZ": {
			"type": "viz.singlevalue",
			"options": {
				"backgroundColor": "$hex$"
			},
			"dataSources": {
				"primary": "ds_iRJ9rn8s"
			},
			"title": "Average Count of Top $count$ Sourcetypes",
			"description": "",
			"encoding": {}
		},
		"viz_aszgf6CD": {
			"type": "viz.text",
			"options": {
				"content": "Text Input",
				"fontWeight": "bold",
				"textColor": "#FFFFFF"
			}
		},
		"viz_Xgrs9smW": {
			"type": "viz.rectangle",
			"options": {
				"fill": "#1A1C20",
				"stroke": "transparent",
				"rx": 4
			}
		},
		"viz_1oEXTiEw": {
			"type": "viz.rectangle",
			"options": {
				"fill": "#1A1C20",
				"stroke": "transparent",
				"rx": 4
			}
		},
		"viz_AC5HOg5v": {
			"type": "viz.rectangle",
			"options": {
				"fill": "#111215",
				"stroke": "transparent",
				"rx": 4
			}
		},
		"viz_oXAXDETA": {
			"type": "viz.rectangle",
			"options": {
				"fill": "#111215",
				"stroke": "transparent",
				"rx": 4
			}
		},
		"viz_MncaqNG1": {
			"type": "viz.text",
			"options": {
				"content": "Number of sourcetypes shown  based on input count. \nColor of header bar changes based on input hex.",
				"fontSize": 14,
				"textColor": "#ACACAD"
			}
		},
		"viz_nkQw0AQv": {
			"type": "viz.text",
			"options": {
				"content": "Dynamic Table Based on Text Inputs",
				"textColor": "#FFFFFF",
				"fontSize": 14,
				"fontWeight": "bold"
			}
		},
		"viz_ARvOjH9G": {
			"type": "viz.text",
			"options": {
				"content": "Text inputs allow users to choose titles, descriptions, and other forms of text entries. ",
				"fontSize": 14,
				"textColor": "#ACACAD"
			}
		},
		"viz_fGDFzSpc": {
			"type": "viz.text",
			"options": {
				"content": "Dynamic Single Value Based on Text Inputs",
				"textColor": "#FFFFFF",
				"fontSize": 14,
				"fontWeight": "bold"
			}
		},
		"viz_TrOPFEfj": {
			"type": "viz.text",
			"options": {
				"content": "Average count changes from \"Input count\"\nBackground color changes from \"Input hex color\"",
				"fontSize": 14,
				"textColor": "#ACACAD"
			}
		}
	},
	"dataSources": {
		"ds_BIdQZ95d": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal | top limit=$count$ sourcetype | eval percent = round(percent,2)"
			},
			"name": "Search_1"
		},
		"ds_iRJ9rn8s": {
			"type": "ds.search",
			"options": {
				"queryParameters": {
					"earliest": "-24h@h",
					"latest": "now"
				},
				"query": "index=_internal | top limit=$count$ sourcetype | stats avg(count)"
			},
			"name": "Search_2"
		}
	},
	"inputs": {
		"input1": {
			"type": "input.text",
			"options": {
				"defaultValue": "5",
				"token": "count"
			},
			"title": "Input count:"
		},
		"input2": {
			"type": "input.text",
			"options": {
				"defaultValue": "#9964F1",
				"token": "hex"
			},
			"title": "Input hex color:"
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"backgroundColor": "#111215",
			"width": 1500,
			"height": 700,
			"showTitleAndDescription": false,
			"display": "auto-scale"
		},
		"structure": [
			{
				"item": "viz_1oEXTiEw",
				"type": "block",
				"position": {
					"x": 770,
					"y": 160,
					"w": 700,
					"h": 470
				}
			},
			{
				"item": "viz_Xgrs9smW",
				"type": "block",
				"position": {
					"x": 30,
					"y": 160,
					"w": 710,
					"h": 470
				}
			},
			{
				"item": "viz_AC5HOg5v",
				"type": "block",
				"position": {
					"x": 790,
					"y": 210,
					"w": 660,
					"h": 380
				}
			},
			{
				"item": "viz_aszgf6CD",
				"type": "block",
				"position": {
					"x": 24,
					"y": 30,
					"w": 300,
					"h": 50
				}
			},
			{
				"item": "viz_oXAXDETA",
				"type": "block",
				"position": {
					"x": 50,
					"y": 210,
					"w": 670,
					"h": 380
				}
			},
			{
				"item": "viz_mz81M1yZ",
				"type": "block",
				"position": {
					"x": 920,
					"y": 300,
					"w": 390,
					"h": 250
				}
			},
			{
				"item": "viz_R8trLpwN",
				"type": "block",
				"position": {
					"x": 70,
					"y": 310,
					"w": 630,
					"h": 280
				}
			},
			{
				"item": "viz_MncaqNG1",
				"type": "block",
				"position": {
					"x": 70,
					"y": 220,
					"w": 360,
					"h": 70
				}
			},
			{
				"item": "viz_nkQw0AQv",
				"type": "block",
				"position": {
					"x": 50,
					"y": 170,
					"w": 530,
					"h": 80
				}
			},
			{
				"item": "viz_ARvOjH9G",
				"type": "block",
				"position": {
					"x": 30,
					"y": 80,
					"w": 570,
					"h": 50
				}
			},
			{
				"item": "viz_fGDFzSpc",
				"type": "block",
				"position": {
					"x": 790,
					"y": 160,
					"w": 530,
					"h": 80
				}
			},
			{
				"item": "viz_TrOPFEfj",
				"type": "block",
				"position": {
					"x": 800,
					"y": 220,
					"w": 360,
					"h": 70
				}
			}
		],
		"globalInputs": [
			"input1",
			"input2"
		]
	},
	"description": "Two text input examples shown changing SPL query, titles, coloring. ",
	"title": "Example — Text Input"
}

input.number

Use this input to ensure that users only enter numbers. This can be particularly useful when you want to pass a token to a search that can only take a numerical argument. Decimals and negative numbers are supported.

The following options are available:

  • defaultValue
  • token
  • min
    Set the minimum number the user can select.
  • max
    Set the maximum number the user can select.
  • step
    Controls the skip interval when using the up and down arrows. For example, with a default value of 0, the number will go to 2 if the user clicks the up value and -2 if the user clicks the down arrow.

The following input stanza example has an initial value of 0, creates a token called maxResults, and allows users to enter any number between and including 0-1000. If the user uses the arrows, the numbers will increase or decrease by increments of 5, though any number can be manually entered. 


"inputs": {
    "input_1": {
        "type": "input.number",
        "options": {
            "defaultValue": 0,
            "token": "maxResults",
            "min": 0,
            "max": 1000,
            "step": 5
        },
        "title": "Number Input"
    }
},

Example: Search-based cascading inputs

The following example uses most of the input features that are supported, including the following:

  • A time range picker to inform all earliest and latest query parameters for each data source.
  • Searches that use tokens to populate values displayed in both the dropdown and the mulitselect inputs (these searches are over a time range determined by the selected time range).
  • A dropdown input that creates a token value based on a user selection. The token is then used in the query that populates the multiselect input menu.
  • The input menus display the current values of the dropdown and multiselect inputs that assign token values used in text visualizations.
  • The text input shows the current value assigned to a token used in a table visualization title.
  • The text input shows the current value of the token used to create a new field in a query in the data source for the table visualization.


An example of a dashboard with search dependent cascading inputs.

Expand this window to copy/paste the dashboard definition into your own dashboard. 

{
	"visualizations": {
		"viz_IPKhkw6F": {
			"type": "viz.bar",
			"options": {
				"backgroundColor": "transparent"
			},
			"dataSources": {
				"primary": "ds_ojhZErLW"
			},
			"title": ""
		},
		"viz_x4CCcLuC": {
			"type": "viz.table",
			"options": {
				"backgroundColor": "transparent"
			},
			"dataSources": {
				"primary": "ds_LsrCPNBY"
			},
			"title": "$txt$"
		},
		"viz_0QcXFMGM": {
			"type": "viz.text",
			"options": {
				"content": "Bar Chart: User is admin \nSourcetype is splunk_web_access,splunkd,splunkd_access,splunkd_ui_access",
				"textColor": "#FBFBFB",
				"fontSize": 14,
				"fontWeight": "bold",
				"fontFamily": "Splunk Data Sans"
			}
		},
		"viz_K8t7HODE": {
			"type": "viz.rectangle",
			"options": {
				"fill": "#111215",
				"stroke": "transparent",
				"rx": 4
			}
		},
		"viz_kqg9Tkkb": {
			"type": "viz.rectangle",
			"options": {
				"fill": "#111215",
				"stroke": "transparent",
				"rx": 4
			}
		},
		"viz_enswfOEX": {
			"type": "viz.text",
			"options": {
				"content": "Table Chart: User is $dd1$",
				"textColor": "#FBFBFB",
				"fontSize": 14,
				"fontWeight": "bold",
				"fontFamily": "Splunk Data Sans"
			}
		}
	},
	"dataSources": {
		"search1": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal \n| stats count by user",
				"queryParameters": {
					"latest": "$trp.latest$",
					"earliest": "$trp.earliest$"
				}
			},
			"name": "User"
		},
		"search2": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user=$dd1$\n| stats count by sourcetype",
				"queryParameters": {
					"latest": "$trp.latest$",
					"earliest": "$trp.earliest$"
				}
			},
			"name": "SourceType"
		},
		"ds_ojhZErLW": {
			"type": "ds.search",
			"options": {
				"queryParameters": {
					"latest": "$trp.latest$",
					"earliest": "$trp.earliest$"
				},
				"query": "index=_internal user=$dd1$ sourcetype IN ($ms1$)\n| stats count by sourcetype"
			},
			"name": "BarChart"
		},
		"ds_LsrCPNBY": {
			"type": "ds.search",
			"options": {
				"query": "index=_internal user=$dd1$ sourcetype IN ($ms1$)\n| head 40\n| table _time, user, sourcetype, _raw\n| eval text_entry=\"$txt$\"\n",
				"queryParameters": {
					"latest": "$trp.latest$",
					"earliest": "$trp.earliest$"
				}
			},
			"name": "Table"
		}
	},
	"inputs": {
		"input_1": {
			"type": "input.timerange",
			"title": "Select Time",
			"options": {
				"defaultValue": "-5m, now",
				"token": "trp"
			}
		},
		"input_2": {
			"type": "input.dropdown",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"token": "dd1",
				"defaultValue": "*"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search1"
			},
			"title": "Select User"
		},
		"input_3": {
			"type": "input.multiselect",
			"options": {
				"items": [
					{
						"label": "All",
						"value": "*"
					}
				],
				"token": "ms1",
				"defaultValue": "*"
			},
			"encoding": {
				"label": "primary[0]",
				"value": "primary[0]"
			},
			"dataSources": {
				"primary": "search2"
			},
			"title": "Select Sourcetype"
		},
		"input_4": {
			"type": "input.text",
			"title": "Enter Text",
			"options": {
				"token": "txt",
				"defaultValue": "My Text"
			}
		}
	},
	"layout": {
		"type": "absolute",
		"options": {
			"height": 600,
			"width": 1440,
			"backgroundColor": "#111215",
			"showTitleAndDescription": false,
			"display": "auto-scale"
		},
		"structure": [
			{
				"item": "viz_0QcXFMGM",
				"type": "block",
				"position": {
					"x": 40,
					"y": 20,
					"w": 550,
					"h": 50
				}
			},
			{
				"item": "viz_K8t7HODE",
				"type": "block",
				"position": {
					"x": 40,
					"y": 70,
					"w": 650,
					"h": 460
				}
			},
			{
				"item": "viz_kqg9Tkkb",
				"type": "block",
				"position": {
					"x": 750,
					"y": 70,
					"w": 650,
					"h": 460
				}
			},
			{
				"item": "viz_enswfOEX",
				"type": "block",
				"position": {
					"x": 750,
					"y": 20,
					"w": 610,
					"h": 50
				}
			},
			{
				"item": "viz_IPKhkw6F",
				"type": "block",
				"position": {
					"x": 70,
					"y": 90,
					"w": 590,
					"h": 380
				}
			},
			{
				"item": "viz_x4CCcLuC",
				"type": "block",
				"position": {
					"x": 780,
					"y": 90,
					"w": 590,
					"h": 430
				}
			}
		],
		"globalInputs": [
			"input_1",
			"input_2",
			"input_3",
			"input_4"
		]
	},
	"description": "",
	"title": "Super Input Dash"
}
Last modified on 19 January, 2021
PREVIOUS
Format a choropleth SVG 		  NEXT
Object options and defaults reference

This documentation applies to the following versions of Splunk® Dashboards App: 0.9.0

Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters