Dashboards & Visualizations

Drill down or drop down "Duplicate values Conflicting errors"

dnv007
Explorer

Hi All,

I have a situation here where i have a lookup table with the below two values:

Field 1 Field 2
aaa g1
ddd g3
eee g2
rrr g2
yyy g3
jjj g1

As you see i have unique values in Field1 which are sub-categories to the Field 2.

My aim is to create a dropdown to display the values in Field 2 uniquely and when for instance g1 is selected the graphs change values as per jjj and aaa.

i have written the query as below which works fine on a search tab:
| inputlookup xxx.csv | lookup xxx.csv Field1 OUTPUTNEW Field2 | mvexpand Field2 | stats count by Field2 | table Field2

However when adding this in a dropdown search string it throws me an error saying "Duplicate values causing conflict"

Could someone help me with this asap please? Much appreciated.

Tags (1)
0 Karma

DMohn
Motivator

If using a query to fill values to a dropdown you have to make sure the values are unique. Please try the following query:

| inputlookup xxx.csv | fields Field2 | dedup Field2
0 Karma

dnv007
Explorer

Thanks Guys!

But i cannot use dedup.
For instance using dedup would remove duplicates as i need all values for say g1.
I need g1 to include both jjj and aaa.

Using dedup would either retrieve jjj or aaa. whereas i need both.

Please suggest a workaround!

0 Karma

DMohn
Motivator

Can you please provide an example for the search you are trying to run from the dropdown? We would need to know the following information to give proper advice:
- Contents of the Dropdown (Label / Value)
- Variables for the search

0 Karma

DavidHourani
Super Champion

Hi @dnv007,

Try this :

| inputlookup xxx.csv | lookup xxx.csv Field1 OUTPUTNEW Field2 | mvexpand Field2 | stats count by Field2 | table Field2 | dedup Field2

Should work well because the dedup command will remove any duplicates.

Cheers,
David

DavidHourani
Super Champion

In the example you gave us you are keeping only Field2 and using Field2 in your dropdown so it doesn't matter what values field1 is taking that's why using dedup on that field will get rid of the error.

In case you need to dedup for both fields, thats also possible you simply add both fields behind the dedup but you can use the dropdown with 2 input value fields.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...