Archive

Drill down or drop down "Duplicate values Conflicting errors"

dnv007
Engager

Hi All,

I have a situation here where i have a lookup table with the below two values:

Field 1 Field 2
aaa g1
ddd g3
eee g2
rrr g2
yyy g3
jjj g1

As you see i have unique values in Field1 which are sub-categories to the Field 2.

My aim is to create a dropdown to display the values in Field 2 uniquely and when for instance g1 is selected the graphs change values as per jjj and aaa.

i have written the query as below which works fine on a search tab:
| inputlookup xxx.csv | lookup xxx.csv Field1 OUTPUTNEW Field2 | mvexpand Field2 | stats count by Field2 | table Field2

However when adding this in a dropdown search string it throws me an error saying "Duplicate values causing conflict"

Could someone help me with this asap please? Much appreciated.

Tags (1)
0 Karma

DMohn
Motivator

If using a query to fill values to a dropdown you have to make sure the values are unique. Please try the following query:

| inputlookup xxx.csv | fields Field2 | dedup Field2
0 Karma

dnv007
Engager

Thanks Guys!

But i cannot use dedup.
For instance using dedup would remove duplicates as i need all values for say g1.
I need g1 to include both jjj and aaa.

Using dedup would either retrieve jjj or aaa. whereas i need both.

Please suggest a workaround!

0 Karma

DMohn
Motivator

Can you please provide an example for the search you are trying to run from the dropdown? We would need to know the following information to give proper advice:
- Contents of the Dropdown (Label / Value)
- Variables for the search

0 Karma

DavidHourani
Super Champion

Hi @dnv007,

Try this :

| inputlookup xxx.csv | lookup xxx.csv Field1 OUTPUTNEW Field2 | mvexpand Field2 | stats count by Field2 | table Field2 | dedup Field2

Should work well because the dedup command will remove any duplicates.

Cheers,
David

DavidHourani
Super Champion

In the example you gave us you are keeping only Field2 and using Field2 in your dropdown so it doesn't matter what values field1 is taking that's why using dedup on that field will get rid of the error.

In case you need to dedup for both fields, thats also possible you simply add both fields behind the dedup but you can use the dropdown with 2 input value fields.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!