I need to use two different inputs in one dashboard to filter the source. One for Apache and another for JBoss:
Apache :
<input type="dropdown" token="WebAppTok" searchWhenChanged="true">
<label>Apache Application</label>
<fieldForLabel>count</fieldForLabel>
<fieldForValue>source</fieldForValue>
Jboss:
<input type="dropdown" token="jBossAppTok" searchWhenChanged="true">
<label>jBoss Application</label>
<fieldForLabel>count</fieldForLabel>
<fieldForValue>source</fieldForValue>
Both the inputs work if I use them in separate dashboards, but I want to use it in the same dashboards, but I'm getting an error saying "duplicate values causing conflict".
Anyway I can get around that?
On your search that is used to populate the dropdown, add |dedup FIELD
so the search doesn't return duplicate values.
For both the inputs?
yep thats correct
@chrisyoungerjds -His search queries for each dropdown show dedup source, in the comment section in question.
Can you type your query to populate the input. Is it a dropdown?
It is a drop down. Below is what I am using for the inputs for apache and jboss
Apache :
| search access_request!="xxx"
| WHERE NOT ( cidrmatch("10.0.0.0/8",clientip) OR cidrmatch("172.16.0.0/12",clientip) OR cidrmatch("128.121.245.0/28",clientip) OR clientip="168.143.160.133" OR clientip="168.143.160.178" OR match(access_request, "(?i).(?:jpg|gif|png|js|css|swf|ico|bmp|pdf|xml)[\?# ]") ) | replace /logs/* with * in source | replace */access.log with * in source | dedup clientip | dedup source
| table source
jBoss:
<label>jBoss Application</label>
<fieldForLabel>count</fieldForLabel>
<fieldForValue>source</fieldForValue>
<search>
<query>index=jboss host=*ch*prd* source= a OR source= b OR source= c
| replace /logs/* with * in source | replace */server.log with * in source | dedup source
| table sourcee