Dashboards & Visualizations

Receiving a Duplicate labels causing conflict error

MichaelPriest
Communicator

I've created a dashboard with a drop down so the user can select different sources. But I'm receiving a "Duplicate labels causing conflict" error, how do I stop this.

I've already read the post listed here:
http://answers.splunk.com/answers/221599/duplicate-labels-causing-conflict.html
but this didn't resolve my issue.

Here's my XML code:

<form>
  <label>TEST</label>
  <description>description</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="source" searchWhenChanged="true">
      <label>Select a Source:</label>
      <search>
        <query>index="test_inputs" sourcetype="Qualys_Desktop" source="*-MS-*" | fields source</query>
        <earliest>-6mon</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Total </title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats count&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Total unique</title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats distinct_count(Title)&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
  </row>
</form>
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

MichaelPriest
Communicator

Thanks very much, I altered my search so it included a top, it's more efficient too:

index="test_inputs" sourcetype="Qualys_Desktop" source="-MS-" | fields source | top source limit=15

0 Karma

jeffland
SplunkTrust
SplunkTrust

Finally, the fields source in that search is unnecessary - top on its own already returns only the source field 🙂

idab
Path Finder

Hello jeffland,

So, I'm having the same problem with my search criteria as well. So, i was wondering if you could help out.
For some reason - I get the same "duplicate values appearing" for some reason.Not sure what i'm doing wrong.
here is my xml for your perusal:

User Activity
Utilization by user activities

<input type="dropdown" token="user" searchWhenChanged="true">
  <label>User_Activity_by_Time</label>
  <search>
    <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1 | search user!="NULL" | top 0 user  </query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>user</fieldForLabel> 
  <fieldForValue>user</fieldForValue>   
  <choice value="*">All</choice>
  <default>*</default>
</input>
<input type="time" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>



<panel>
  <title>User Activity: $user$</title>
  <chart>
    <search>
      <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1  </query>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Tx IN GBps</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">area</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.axisTitleY.text">number of loggers</option>
  </chart>
</panel>
0 Karma

jeffland
SplunkTrust
SplunkTrust

That's strange, top should not return duplicate values. Have you had a look and run the search manually?

0 Karma

MichaelPriest
Communicator

Thanks very much

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...