Dashboards & Visualizations

Receiving a Duplicate labels causing conflict error

MichaelPriest
Communicator

I've created a dashboard with a drop down so the user can select different sources. But I'm receiving a "Duplicate labels causing conflict" error, how do I stop this.

I've already read the post listed here:
http://answers.splunk.com/answers/221599/duplicate-labels-causing-conflict.html
but this didn't resolve my issue.

Here's my XML code:

<form>
  <label>TEST</label>
  <description>description</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="source" searchWhenChanged="true">
      <label>Select a Source:</label>
      <search>
        <query>index="test_inputs" sourcetype="Qualys_Desktop" source="*-MS-*" | fields source</query>
        <earliest>-6mon</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Total </title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats count&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Total unique</title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats distinct_count(Title)&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
  </row>
</form>
0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

MichaelPriest
Communicator

Thanks very much, I altered my search so it included a top, it's more efficient too:

index="test_inputs" sourcetype="Qualys_Desktop" source="-MS-" | fields source | top source limit=15

0 Karma

jeffland
SplunkTrust
SplunkTrust

Finally, the fields source in that search is unnecessary - top on its own already returns only the source field 🙂

idab
Path Finder

Hello jeffland,

So, I'm having the same problem with my search criteria as well. So, i was wondering if you could help out.
For some reason - I get the same "duplicate values appearing" for some reason.Not sure what i'm doing wrong.
here is my xml for your perusal:

User Activity
Utilization by user activities

<input type="dropdown" token="user" searchWhenChanged="true">
  <label>User_Activity_by_Time</label>
  <search>
    <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1 | search user!="NULL" | top 0 user  </query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>user</fieldForLabel> 
  <fieldForValue>user</fieldForValue>   
  <choice value="*">All</choice>
  <default>*</default>
</input>
<input type="time" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>



<panel>
  <title>User Activity: $user$</title>
  <chart>
    <search>
      <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1  </query>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Tx IN GBps</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">area</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.axisTitleY.text">number of loggers</option>
  </chart>
</panel>
0 Karma

jeffland
SplunkTrust
SplunkTrust

That's strange, top should not return duplicate values. Have you had a look and run the search manually?

0 Karma

MichaelPriest
Communicator

Thanks very much

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...