topic Re: Duplicate labels causing conflict in Getting Data In

Duplicate labels causing conflict

Joannelr — Sun, 07 Jun 2020 01:27:58 GMT

I have this problem on my dashboard, "Duplicate labels causing conflict" what would be the cause of this? I have checked that i dont have any duplicated labels.

Thank you

Re: Duplicate labels causing conflict

ngatchasandra — Fri, 13 Mar 2015 12:01:48 GMT

Can you post your xml code?

Re: Duplicate labels causing conflict

Joannelr — Fri, 13 Mar 2015 12:53:51 GMT

<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="staff_email" searchWhenChanged="true">
  <label>Email</label>
  <choice value="*">All</choice>
  <search>
    <query>|sort dataa_alias|table dataa_alias</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>dataa_alias</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="gadget_os" searchWhenChanged="true">
  <label>gadget OS</label>
  <choice value="*">All</choice>
  <search>
    <query>| tstats count from datamodel=switch_dm where ( nodename=switch._switch_ping ) AND  (switch.dataa_alias=*)  GROUPBY  switch.gadget_os|sort switch.gadget_os|table switch.gadget_os</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>switch.gadget_os</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="phone" searchWhenChanged="true">
  <label>Phone</label>
  <choice value="*">All</choice>
  <search>
    <query>| tstats count from datamodel=switch_dm where ( nodename=switch.switch_ping ) AND  (switch.dataa_alias=*)  GROUPBY  switch.sd_name|sort switch.sd_name|table switch.sd_name</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>switch.sd_name</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="team" searchWhenChanged="true">
  <label>Team</label>
  <choice value="*">All</choice>
  <choice value="null">Null</choice>
  <search>
    <query>|inputlookup|dedup Team|sort Team|table Team</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>Team</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="uid" searchWhenChanged="true">
  <label>UID</label>
  <search>
    <query>| inputlookup |sort data_uid|table data_uid</query>
  </search>
  <fieldForLabel>data_uid</fieldForLabel>
  <fieldForValue>data_uid</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
</input>


<panel>
  <table>
    <title>Pivot Report - By Staff</title>
    <search>
      <query>| tstats count from datamodel=switch_dm where ( nodename=switch._switch_ping ) AND  (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY   _time span=1d switch.dataa_alias|lookup_switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS  dataa_alias|lookup staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$" |eval "Date" = strftime(_time, "%F %T")|rename dataa_alias As Email |chart limit=30 values(count) by Email,Date</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <drilldown>
      <set token="staff_email">$row.Email$</set>
      <set token="form.staff_email">$row.Email$</set>
    </drilldown>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">heatmap</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>
<panel>
  <table>
    <title>Pivot Report - By Team</title>
    <search>
      <query>| tstats count from datamodel= switch_dm where ( nodename= switch. switch_ping ) AND  (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY   _time span=1d switch.dataa_alias|lookup switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS  dataa_alias|lookup _staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$"  |eval "Date" = strftime(_time, "%F %T")|rename switch.dataa_alias As Email | chart limit=30 sum(count) by Team,Date</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <drilldown>
      <set token="team">$row.Team$</set>
      <set token="form.team">$row.Team$</set>
    </drilldown>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>


<panel>
  <chart>
    <title>Staff Chart</title>
    <search>
      <query>| tstats count from datamodel=switch_dm where ( nodename=switch.switch_ping ) AND  (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY   _time  switch.dataa_alias|lookup switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS  dataa_alias|lookup _staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$"  |rename switch.dataa_alias As Email |timechart values(count) by Email limit=30</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>

Re: Duplicate labels causing conflict

somesoni2 — Fri, 13 Mar 2015 13:44:46 GMT

For which dropdown you're getting duplicate label error?

Re: Duplicate labels causing conflict

Joannelr — Mon, 16 Mar 2015 06:21:17 GMT

The UID drop down

Re: Duplicate labels causing conflict

Ozyolcular — Mon, 28 Sep 2020 19:27:30 GMT

Similar problem in 6.2.1. In my case Label (EnvName) is unique but Value (EnvId) is duplicate. Splunk shall not report it as "Duplicate labels causing conflict" because there is no conflict..

EnvName

FullInstall

titanium_server_15

and corresponding Values

EnvId

titanium_server_15
titanium_server_15

  <input type="multiselect" token="envIdTok" searchWhenChanged="true">
    <label>Environment/Profile</label>
    <choice value='None'></choice>
    <delimiter> OR </delimiter>
    <valuePrefix>EnvId="</valuePrefix>
    <valueSuffix>"</valueSuffix>
    <search>
      <query>index=eidx RNTid="$rlskey$" | dedup EnvName | table EnvName, EnvId</query>
    </search>
    <fieldForLabel>EnvName</fieldForLabel>
    <fieldForValue>EnvId</fieldForValue>        
    <change>
      <set token="tr">*</set>
      <set token="timeTokLatest">$timeTok.latest$</set>
      <set token="runDateTok">0</set>
    </change>
  </input>

Re: Duplicate labels causing conflict

asherman — Mon, 13 Apr 2015 15:47:32 GMT

I get the same issue using the following snippet:

      <choice value="primary">Primary</choice>

I had no issue using this code in version 6.0.1, I believe. Upgrading to 6.2.1 introduced the 'Duplicate..." error. The event 'primary' is returned by the populating search in the dropdown menu that uses this, and this xml node was used to rename that value.

I don't see why this should raise any flags from the GUI.

Re: Duplicate labels causing conflict

mjones414 — Wed, 08 Jul 2015 19:07:51 GMT

Also getting this on every drop down in 6.2.3 using the same xml syntax

Re: Duplicate labels causing conflict

edroche3rd — Wed, 22 Jul 2015 21:36:37 GMT

Same Issue as well 6.2.4 Ent

Here is my code:

  <label>NetQoS</label>
  <choice value='None'></choice>
  <search>
    <query>| inputlookup belts.csv</query>
  </search>
  <fieldForLabel>Level</fieldForLabel>
  <fieldForValue>l_val</fieldForValue>
</input>

Input csv only has 5 lines:

White
Orange
Blue
Red
Black

Any thoughts?

Thanks
Ed

Re: Duplicate labels causing conflict

jeremiahc4 — Wed, 09 Sep 2015 15:00:09 GMT

Has anyone received an answer to this yet? I'm having the same problem. I'm using an inputlookup that has duplicates in fields I'm not including in my populating search (index, sourcetype, etc...). I'm only including a description field which I'm doing a dedup on in the populating search.

| inputlookup my_lookups | search field1="blah" | dedup description | table description

This search produces a table of 4 distinct values from my_lookups, if I take the table command off the end, I see there are duplicates in various other fields in the lookup.

Re: Duplicate labels causing conflict

tdiestel — Thu, 10 Sep 2015 22:19:43 GMT

This error will arise when you have a table that has either duplicate "labels" or duplicate "values". Ensure that when you do ...|table fieldA fieldB that fieldA contains unique values and fieldB contains unique values. To do this you could blindly do the below but double check that the outcome is what you want:

...|dedup fieldA| dedup fieldB|table fieldA fieldB

Re: Duplicate labels causing conflict

lisaac — Tue, 01 Dec 2015 19:32:57 GMT

This solution here worked link text

Re: Duplicate labels causing conflict

vcgamesii — Sun, 20 Dec 2015 21:41:58 GMT

This solution worked for me (having duplicate values within a field). https://answers.splunk.com/answers/240661/receiving-a-duplicate-labels-causing-conflict-erro.html

Re: Duplicate labels causing conflict

vcgamesii — Sun, 20 Dec 2015 21:46:58 GMT

This solution worked for me when I had duplicates in the values of a field.

(top was faster than dedup in my case).

https://answers.splunk.com/answers/240661/receiving-a-duplicate-labels-causing-conflict-erro.html

Re: Duplicate labels causing conflict

scottecclestone — Tue, 26 May 2020 14:59:45 GMT

Your query is returning values for the Label and values for the Value. At least two different Label values correspond to the exact same Value value. That's the issue causing this warning. Your code will still work (hence warning, rather than error.) There are many ways to solve it. In my case it's really the logged records that were wrong, not the Splunk query, so I left it alone but asked for a fix to the logging.