topic Re: Duplicate values causing conflict in Splunk Search

Duplicate values causing conflict

splunk_UCL — Thu, 24 Aug 2017 09:25:46 GMT

Hi Splunkers,

below form (dynamic dropdown) creates "Duplicate values causing conflict"
Any ideas?

<form> 
  <label>test</label>
  <fieldset submitButton="false">
    <input type="time" searchWhenChanged="true" token="time">
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>

  <input type="dropdown" token="source" searchWhenChanged="true">
            <choice value="*">All</choice>
            <search>
                <query>index=_internal | top date_second | dedup date_second | table date_second</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
            </search>
  </input>

  </fieldset>
</form>

Re: Duplicate values causing conflict

cmerriman — Thu, 24 Aug 2017 13:49:32 GMT

you shouldn't need the |dedup date_second as the |top date_second wouldn't bring in duplicate values.

try this:

<input type="dropdown" token="source" searchWhenChanged="true">
      <label>source</label>
      <choice value="*">All</choice>
      <search>
        <query>index=_internal | top date_second | table date_second</query>
           <earliest>$time.earliest$</earliest>
           <latest>$time.latest$</latest>
      </search>
      <fieldForLabel>date_second</fieldForLabel>
      <fieldForValue>date_second</fieldForValue>
    </input>

Re: Duplicate values causing conflict

splunk_UCL — Thu, 24 Aug 2017 14:41:42 GMT

     <form> 
       <label>deleteme</label>
       <fieldset submitButton="false">
         <input type="time" searchWhenChanged="true" token="time">
           <default>
             <earliest>-24h@h</earliest>
             <latest>now</latest>
           </default>
         </input>

       <input type="dropdown" token="source" searchWhenChanged="true">
                 <choice value="*">All</choice>
                       <fieldForLabel>date_second</fieldForLabel>
                       <fieldForValue>date_second</fieldForValue>
                 <search>
                     <query>index=_internal | top date_second | dedup date_second | table date_second</query>
               <earliest>$time.earliest$</earliest>
               <latest>$time.latest$</latest>
                 </search>
       </input>

       </fieldset>
     </form>

Re: Duplicate values causing conflict

splunk_UCL — Thu, 24 Aug 2017 14:44:50 GMT

found out by myself.

fieldForLabel and fieldForValue

were missing