Dropdown producing duplicate entries

[corwinz6]

Hello,

I am trying to make a dashboard with a drop down for selecting between various devices logging to Splunk, a time range picker, and having the charts/tables on that dashboard change depending on what is selected. If I remove "| dedup devname" from my populating search string I get results in the drop down but there are many duplicates. With that syntax in place no results are generated in the drop down (but if I plug the syntax into my Splunk search it returns correctly). The rest of the functionality seemed to work with my dashboard that I have written so far in that once a device is select the table varies based on it and the time picker. Below is my code:

<form>
<label>Fortigate</label>
  <fieldset autoRun="true">    
    <input type="dropdown" token="fortigate" searchWhenChanged="true">
    <label>Select Device</label>
<populatingSearch fieldForValue="devname" fieldForLabel="devname">
    sourcetype=fortinet | fields devname | dedup devname
</populatingSearch>
    </input>
   <input type="time" />
  </fieldset>
<row>
  <table>
  <title>Top Denied</title> 
 <searchTemplate>sourcetype=fortinet devname="$fortigate$" rule=3000 | top dest</searchTemplate> 
   </table>
</row>
</form>

What can I do to remove the duplicates and still keep the same functionality? I know you can use a csv file to load the contents of the dropdown but I'd prefer something more dynamic.

Thanks

[corwinz6 · Accepted solution]

It seems the issue was with the amount of data the search was going through to produce results for the dropdown. By using the following summary index search:
sourcetype=fortinet | sistats count by Mgmt_IP, devname
and tying that to:
<![CDATA[index=summary search_name="Summary_devname_populate" | rex "(?i) Mgmt_IP=\"(?P[^\"]+)" | dedup Mgmt_IP | stats count by Mgmt_IP devname]]>

I was able to properly gather a unique list of all device names for the drop down menu.

[HattrickNZ]

tks

I was using something like but was getting a duplicates error in the drop down
...table Mgmt_IP devname| dedup Mgmt_IP devname

I was suing something like but was getting a duplicates error
... top SBC_TGN_TGID measObjLdn

but finally your solution helped me.
.. dedup Mgmt_IP | stats count by Mgmt_IP devname

[lguinn2]

I don't know that this will work any better, but you could try

sourcetype=fortinet | dedup devname

or

sourcetype=fortinet | dedup devname | table devname

[corwinz6]

Unfortunately those did not work either. I tried doing the dedup command on a second field which is specific to each device while still telling to display devname but again it just never loads while the search itself works fine.

[Ayn]

Your code looks OK to me. I just tried it in a very similar XML and it worked as it should, so why it won't work for you is beyond me I'm afraid. However one thing you could try is to use

sourcetype=fortinet | stats count by devname

which will give you kind of an implicit dedup.

[corwinz6]

When I try that the dropdown never finished "loading".