Duplicate values causing conflict with dropdown.

[piefragn]

Hi,

I have a dropdown input populated with this search:

index=apache_nifi "info.eventSource"="QDH" |  sort 0 headers.ispwebServiceHeader.requestInfo.serviceID | fields headers.ispwebServiceHeader.requestInfo.serviceID | dedup headers.ispwebServiceHeader.requestInfo.serviceID

and with these configurations:

Field For Label: headers.ispwebServiceHeader.requestInfo.serviceID
Field For Value: headers.ispwebServiceHeader.requestInfo.serviceID

But, I always get this error:
"Duplicate values causing conflict"

Also, if values are really unique (I tested the query in a separate search).

I tried with other Answers but with no positive results.

Any ideas?

Thanks a lot.

[vnravikumar · Accepted solution]

Hi @piefragn

Try like

index=apache_nifi "info.eventSource"="QDH"
| stats count by headers.ispwebServiceHeader.requestInfo.serviceID
| sort 0 By headers.ispwebServiceHeader.requestInfo.serviceID

[piefragn]

It works, thank you @vnravikumar

Why do you use the stats count instead of the dedup?

I'm newer to Splunk.

Thanks a lot!

[vnravikumar]

It takes less time when compared to dedup