Advanced Dashboards • Room 1

Form Inputs & Tokens

Splunk dashboards become truly interactive through Form Inputs. Text inputs, dropdowns, multiselects, and time pickers all emit Tokens that drive search behavior.

Token syntax follows the pattern `$token_name$` in Simple XML. When a user selects a dropdown value, the token is set, and every search referencing that token re-executes automatically.

Use `<default>` and `<initialValue>` to pre-populate tokens so your dashboard loads data immediately instead of showing a blank panel.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Allows picking from a list of options

Accepts free-text user input

Selects a relative or absolute time window

Allows picking multiple values simultaneously

Dropdown

Text Input

Time Picker

Multiselect