topic Re: Why I have "Duplicate values causing conflict" with eval ? in Splunk Search

Why I have "Duplicate values causing conflict" with eval ?

Abarny — Fri, 21 Apr 2017 08:17:48 GMT

Hi,

Can you tell me why i can't update my dynamic list on my dashboard ? I have this message : "Duplicate values causing conflict"

 index="gta_projets" 
|  eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
| dedup acteur 
|top 200 acteur | sort by acteur

Thanks you for your answer,

Re: Why I have "Duplicate values causing conflict" with eval ?

niketn — Fri, 21 Apr 2017 08:55:03 GMT

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200

Re: Why I have "Duplicate values causing conflict" with eval ?

Abarny — Fri, 21 Apr 2017 09:04:15 GMT

Thanks for your answer,

I have same probleme, i write like you but I can't take all values in acteur cause it's a concatenation enter firstName and lastName

index="gta_projets"  logs{}.user.firstName="*"  logs{}.user.lastName="*" 
  | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
  | dedup acteur 
  | sort acteur
  | head 25

Re: Why I have "Duplicate values causing conflict" with eval ?

niketn — Fri, 21 Apr 2017 09:32:24 GMT

@Abarny, Can you share the XML code for your input?

Do you see something like <choice value="<SomeValue>"><Some Label></choice>

Re: Why I have "Duplicate values causing conflict" with eval ?

Abarny — Fri, 21 Apr 2017 09:38:02 GMT

It's okay i have puplate my list. Thaks niketnilay

Re: Why I have "Duplicate values causing conflict" with eval ?

niketn — Fri, 21 Apr 2017 11:03:38 GMT

@Abarny...Cheers!!! 🙂 I have converted my comment to answer. Please accept to mark this question as answered if this helped!