Dashboards & Visualizations

Duplicate values causing conflict with dropdown.

piefragn
Engager

Hi,

I have a dropdown input populated with this search:

index=apache_nifi "info.eventSource"="QDH" |  sort 0 headers.ispwebServiceHeader.requestInfo.serviceID | fields headers.ispwebServiceHeader.requestInfo.serviceID | dedup headers.ispwebServiceHeader.requestInfo.serviceID

and with these configurations:

Field For Label: headers.ispwebServiceHeader.requestInfo.serviceID
Field For Value: headers.ispwebServiceHeader.requestInfo.serviceID

But, I always get this error:
"Duplicate values causing conflict"

Also, if values are really unique (I tested the query in a separate search).

I tried with other Answers but with no positive results.

Any ideas?

Thanks a lot.

0 Karma
1 Solution

vnravikumar
Champion

Hi @piefragn

Try like

index=apache_nifi "info.eventSource"="QDH"
| stats count by headers.ispwebServiceHeader.requestInfo.serviceID
| sort 0 By headers.ispwebServiceHeader.requestInfo.serviceID

View solution in original post

vnravikumar
Champion

Hi @piefragn

Try like

index=apache_nifi "info.eventSource"="QDH"
| stats count by headers.ispwebServiceHeader.requestInfo.serviceID
| sort 0 By headers.ispwebServiceHeader.requestInfo.serviceID

View solution in original post

piefragn
Engager

It works, thank you @vnravikumar

Why do you use the stats count instead of the dedup?

I'm newer to Splunk.

Thanks a lot!

0 Karma

vnravikumar
Champion

It takes less time when compared to dedup

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!