Receiving a Duplicate labels causing conflict error

[MichaelPriest]

I've created a dashboard with a drop down so the user can select different sources. But I'm receiving a "Duplicate labels causing conflict" error, how do I stop this.

I've already read the post listed here:
http://answers.splunk.com/answers/221599/duplicate-labels-causing-conflict.html
but this didn't resolve my issue.

Here's my XML code:

<form>
  <label>TEST</label>
  <description>description</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="source" searchWhenChanged="true">
      <label>Select a Source:</label>
      <search>
        <query>index="test_inputs" sourcetype="Qualys_Desktop" source="*-MS-*" | fields source</query>
        <earliest>-6mon</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Total </title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats count&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Total unique</title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats distinct_count(Title)&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
  </row>
</form>

[jeffland · Accepted solution]

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

[MichaelPriest]

Thanks very much, I altered my search so it included a top, it's more efficient too:

index="test_inputs" sourcetype="Qualys_Desktop" source="-MS-" | fields source | top source limit=15

[jeffland]

Finally, the fields source in that search is unnecessary - top on its own already returns only the source field 🙂

[idab]

Hello jeffland,

So, I'm having the same problem with my search criteria as well. So, i was wondering if you could help out.
For some reason - I get the same "duplicate values appearing" for some reason.Not sure what i'm doing wrong.
here is my xml for your perusal:

User Activity
Utilization by user activities

<input type="dropdown" token="user" searchWhenChanged="true">
  <label>User_Activity_by_Time</label>
  <search>
    <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1 | search user!="NULL" | top 0 user  </query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>user</fieldForLabel> 
  <fieldForValue>user</fieldForValue>   
  <choice value="*">All</choice>
  <default>*</default>
</input>
<input type="time" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>



<panel>
  <title>User Activity: $user$</title>
  <chart>
    <search>
      <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1  </query>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Tx IN GBps</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">area</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.axisTitleY.text">number of loggers</option>
  </chart>
</panel>

[jeffland]

That's strange, top should not return duplicate values. Have you had a look and run the search manually?

[MichaelPriest]

Thanks very much