topic Re: Duplicate Values causing Conflict | Can't Fix in Splunk Search

Duplicate Values causing Conflict | Can't Fix

kokanne — Mon, 30 Apr 2018 07:44:42 GMT

Hey, I'm trying to create a dashboard where there can be multiple entries for a field. There is a report behind my multi-select value on the dashboard.

I have made sure to name everything appropriately and that there are no duplicate fields. My query for the report is:
-snip-

I don't understand why it still says that duplicate values are causing a conflict. The following are my settings in the dashboard:

-snip-

Is there anything that can be done to fix this?

Re: Duplicate Values causing Conflict | Can't Fix

kamlesh_vaghela — Mon, 30 Apr 2018 07:52:53 GMT

@kokanne,

I hope you checked data with Executing search in search bar and no value is duplicated.

Can you please correct in settings.

Field for Label: label
Field for Value: value

Field for Label: CVE
Field for Value: CVE

Thanks

Re: Duplicate Values causing Conflict | Can't Fix

xpac — Mon, 30 Apr 2018 09:19:42 GMT

Two hints:
The line | search CVE= "*" contains a space, that might cause trouble.
The sort function has an implicit limit of 10000, so you might not get all results. Improve this by using | sort 0 -CVE.

Re: Duplicate Values causing Conflict | Can't Fix

kokanne — Mon, 30 Apr 2018 13:50:05 GMT

This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.

Re: Duplicate Values causing Conflict | Can't Fix

kokanne — Mon, 30 Apr 2018 13:50:11 GMT

This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.

Re: Duplicate Values causing Conflict | Can't Fix

woodcock — Mon, 30 Apr 2018 16:15:02 GMT

Try this (cut and paste so you don't have problems mis-typing whitespace); this assumes that there are no commas in the CVE names:

| inputlookup qualys_kb_lookup 
| makemv delim="," CVE
| mvexpand CVE 
| rex field=CVE mode=sed "s/^[\r\n\s]+// s/[\r\n\s]+$//"
| search CVE= "*" 
| dedup CVE 
| sort 0 - CVE 
| fields CVE

Re: Duplicate Values causing Conflict | Can't Fix

kokanne — Mon, 07 May 2018 06:18:45 GMT

The answer was changing the label and the value. Besides that I changed the sort to sort 0 - CVE