Dashboards & Visualizations

Receiving a Duplicate labels causing conflict error

MichaelPriest
Communicator

I've created a dashboard with a drop down so the user can select different sources. But I'm receiving a "Duplicate labels causing conflict" error, how do I stop this.

I've already read the post listed here:
http://answers.splunk.com/answers/221599/duplicate-labels-causing-conflict.html
but this didn't resolve my issue.

Here's my XML code:

<form>
  <label>TEST</label>
  <description>description</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="source" searchWhenChanged="true">
      <label>Select a Source:</label>
      <search>
        <query>index="test_inputs" sourcetype="Qualys_Desktop" source="*-MS-*" | fields source</query>
        <earliest>-6mon</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>Total </title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats count&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Total unique</title>
        <search>
          &lt;query&gt;index="test_inputs" source="$source$" Type="Vuln" | stats distinct_count(Title)&lt;/query&gt;
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="linkView">search</option>
      </single>
    </panel>
  </row>
</form>
0 Karma
1 Solution

jeffland
Champion

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

View solution in original post

jeffland
Champion

Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table and dedup.

View solution in original post

MichaelPriest
Communicator

Thanks very much, I altered my search so it included a top, it's more efficient too:

index="test_inputs" sourcetype="Qualys_Desktop" source="-MS-" | fields source | top source limit=15

0 Karma

jeffland
Champion

Finally, the fields source in that search is unnecessary - top on its own already returns only the source field 🙂

idab
Path Finder

Hello jeffland,

So, I'm having the same problem with my search criteria as well. So, i was wondering if you could help out.
For some reason - I get the same "duplicate values appearing" for some reason.Not sure what i'm doing wrong.
here is my xml for your perusal:

User Activity
Utilization by user activities

<input type="dropdown" token="user" searchWhenChanged="true">
  <label>User_Activity_by_Time</label>
  <search>
    <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1 | search user!="NULL" | top 0 user  </query>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>user</fieldForLabel> 
  <fieldForValue>user</fieldForValue>   
  <choice value="*">All</choice>
  <default>*</default>
</input>
<input type="time" searchWhenChanged="true">
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>



<panel>
  <title>User Activity: $user$</title>
  <chart>
    <search>
      <query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1  </query>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Tx IN GBps</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">area</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.axisTitleY.text">number of loggers</option>
  </chart>
</panel>
0 Karma

jeffland
Champion

That's strange, top should not return duplicate values. Have you had a look and run the search manually?

0 Karma

MichaelPriest
Communicator

Thanks very much

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.