topic Duplicate events causing conflict - how to eliminate in Splunk Search

Duplicate events causing conflict - how to eliminate

ablumenthal_spl — Tue, 29 Sep 2020 06:53:09 GMT

I'm trying to create a series of inputs that require a change on selection.

The first one drops down a list of users via a lookup table. It also pulls a list of states associated to their names. The query looks like this:

sourcetype=XXX | lookup territory.csv State as "Abbrev_State" OUTPUT Rep as Rep | top Rep | dedup Rep

*** my sourcetype has the information on states and cities. The original sourcetype is a CSV. I uploaded the lookup. dedup has not solved this problem for me.

The second query is meant to drop down the states associated with their names. I'm also getting the same error on duplicate labels.
Here's my Query:

sourcetype=XXX | lookup territory.csv State as "Abbrev_State" OUTPUT Rep as Rep | search Rep="XXXX" | stats values(Abbrev_State) as States | mvexpand States

My third query is meant to provide a list of the cities within that state. Again, the duplicate labels causing conflict.

sourcetype=XXX | lookup territory.csv State as "Abbrev_State" OUTPUT Rep as Rep | search Rep="XXX" "Abbrev_State"=XX | stats values(Abbrev_City) as City | mvexpand City

I've been using the GUI only to modify my inputs. I can copy the XML if necessary. Any help would appreciated.

Re: Duplicate events causing conflict - how to eliminate

somesoni2 — Wed, 05 Aug 2015 15:30:44 GMT

The XML would be good to have for providing proper solution. Meanwhile, try this-
Replace your first query with this

sourcetype=XXX | lookup territory.csv State as "Abbrev_State" OUTPUT Rep as Rep | stats count by Rep

Replace your 2nd query with this

sourcetype=XXX | lookup territory.csv State as "Abbrev_State" OUTPUT Rep as Rep | search Rep="XXXX" | stats  count by Abbrev_State | rename Abbrev_State as States

Replace your 3rd query with this

sourcetype=XXX | lookup territory.csv State as "Abbrev_State" OUTPUT Rep as Rep | search Rep="XXX" "Abbrev_State"=XX | stats count by Abbrev_City | rename Abbrev_City as City

Re: Duplicate events causing conflict - how to eliminate

richgalloway — Wed, 05 Aug 2015 15:38:14 GMT

You say you're "getting the same error", but I don't see where you say what that error is.

Re: Duplicate events causing conflict - how to eliminate

tom_frotscher — Thu, 06 Aug 2015 12:50:20 GMT

Hi,

this should be caused by a label that is more than one time in the set of labels available to your dropwown.

So you can check the options of the dropdown. Which field of your dynamic search is marked as field for the labels, and which one is marked for the values. Maybe you interchanged them?

Also, i run in in this problem often, because for a first run on the dashboard i just add some static labels and values to the inputs for test purpose. Later i implement the dynamic search, but sometimes the labels of your static options are equal to results of your dynamic search. Did you check that you have none or at least unique static labels in your dropdowns?

@richgalloway: the error is "duplicate labels causing conflict"

Greetings

Tom

Re: Duplicate events causing conflict - how to eliminate

ablumenthal_spl — Thu, 06 Aug 2015 13:34:22 GMT

Apologies! "Duplicate Labels causing conflict" was the error. I solved the problem per Tom's suggestion!

Re: Duplicate events causing conflict - how to eliminate

ablumenthal_spl — Thu, 06 Aug 2015 13:34:45 GMT

Exactly my problem. Thank's Tom. I appreciate your help.