topic Drop-down error "Duplicate values causing conflict" - Dedup not working? in Splunk Search

Drop-down error "Duplicate values causing conflict" - Dedup not working?

Svill321 — Wed, 07 Jun 2017 18:25:31 GMT

Hi everyone,

I'm trying to dynamically populate a dropdown menu with error codes. Obviously, I don't want duplicate values, so I used dedup to remove them:

Error Codes

<panel>
  <input type="dropdown" token="error_tok">
    <label>field1</label>
    <populatingSearch fieldForLabel="name" fieldForValue="name">sourcetype=SOURCE ErrorCode=* |dedup ErrorCode | stats count by ErrorCode</populatingSearch>
    <default>*</default>
  </input>
  <table>
    <search>
      <query>sourcetype=SOURCE ErrorCode=$error_tok$ | table host ErrorCode</query>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
  </table>
</panel>

I am still receiving a duplication error from the drop-down, though. Could someone let me know what I'm doing wrong?

Re: Drop-down error "Duplicate values causing conflict" - Dedup not working?

adonio — Wed, 07 Jun 2017 18:43:38 GMT

try ... | dedup ErrorCode | table ErrorCode
the stats count by ... gives you 2 columns, ErrorCode and count
hope it helps

Re: Drop-down error "Duplicate values causing conflict" - Dedup not working?

Svill321 — Wed, 07 Jun 2017 18:51:14 GMT

No, still getting the same issue.

Re: Drop-down error "Duplicate values causing conflict" - Dedup not working?

adonio — Wed, 07 Jun 2017 18:57:45 GMT

<panel>
<input type="dropdown" token="error_tok" searchWhenChanged="true">
      <label>field1</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>ErrorCode</fieldForLabel>
      <fieldForValue>ErrorCode</fieldForValue>
      <search>
        <query>sourcetype=SOURCE ErrorCode=* | fields ErrorCode|dedup ErrorCode |table ErrorCode</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
<table>
     <search>
       <query>sourcetype=SOURCE ErrorCode=$error_tok$ | table host ErrorCode</query>
       <earliest>-4h@m</earliest>
       <latest>now</latest>
     </search>
   </table>
 </panel>

Re: Drop-down error "Duplicate values causing conflict" - Dedup not working?

Balajiraj — Thu, 22 Jun 2017 03:30:47 GMT

I see that you have used fieldForLabel and fieldForvalue have same value. Have u tried changing them as mentioned in below post

https://answers.splunk.com/answers/329960/duplicate-values-causing-conflict.html

Re: Drop-down error "Duplicate values causing conflict" - Dedup not working?

rrovers — Mon, 04 Sep 2017 08:57:07 GMT

I think you should use fieldForValue="ErrorCode",I think you should use fieldForValue="Errorcode"

Re: Drop-down error "Duplicate values causing conflict" - Dedup not working?

koshyk — Thu, 28 Nov 2019 14:35:35 GMT

I know this is an old post, but just adding a sample

Putting an example to make it simpler

good practice to put "_tok" in the token name, so it is not confused with field/label names
also try to query wrapped in CDATA just to ensure double quotes, arrow symbols won't cause problems
uses "search" rather than the deprecated "populatingSearch" notation
and is a working dashboard (to try out)

sample code

<form>
  <label>REMOVE THIS DASHBOARD ANYTIME</label>
  <description>Some Description</description>
  <fieldset autoRun="false">
    <input type="dropdown" token="sourcetype_tok" searchWhenChanged="false">
      <label>label_name</label>
      <choice value="*">All</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
      <query>
        <![CDATA[index=_internal | stats count by sourcetype
        ]]>
      </query>
      <earliest>$timeSpan.earliest$</earliest>
      <latest>$timeSpan.latest$</latest>
      </search>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
    </input>
    <input type="time" token="timeSpan">
      <label>Time Picker</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Event Details</title>
        <search>
          <query>
          <![CDATA[index=_internal sourcetype=$sourcetype_tok$
            | head 1000
            | table _time,index,sourcetype,source,_raw
            ]]>
          </query>
        <earliest>$timeSpan.earliest$</earliest>
        <latest>$timeSpan.latest$</latest>
        </search>
        <option name="count">20</option>
      </table>
    </panel>
  </row>
</form>