Splunk Dev

Duplicate values causing conflict - populate radio menu button

LNebout
Path Finder

Hello,
I have a problem on xml code.
I try to populate a radio menu button. I have all good entries but every time i receive this message : Duplicate values causing conflict
code :

<input type="radio" token="sourcetype1">
        <label>Source</label>
                    <search>
                              <query>host=WIKI sourcetype="secure*.log"</query>
                   </search>
        <fieldForLabel>sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
</input>

I think the problem is with fieldForLabel and fieldForValue : same name
How can there values renamed ?
Best regards,
Laurent

Tags (1)
1 Solution

niketn
Legend

The is not because of Field For Label and Field For Value being the same. They can be the same search field extracted by you. The reason why you are getting duplicates is because you have multiple events with same sourcetype returned. Out of the several ways you should pick anyone to pull only unique sourcetype. For example the following should give unique sourcetype through dedup command.

 <input type="radio" token="sourcetype1">
         <label>Source</label>
                     <search>
                               <query>host=WIKI sourcetype="secure*.log"
| dedup sourcetype
| sort sourcetype
| table sourcetype</query>
                    </search>
         <fieldForLabel>sourcetype</fieldForLabel>
         <fieldForValue>sourcetype</fieldForValue>
 </input>

The purpose of Label and Value fields being different is to allow you to Display something meaningful to users through label and use hidden Value for performing actual search. For example if you search returns AccountName and AccountNumber. You can choose AccountName as Label and AccountNumber as Value.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

LNebout
Path Finder

Thanks niketnilay ^_^
That works perfectly !!!!
Laurent

0 Karma

DalJeanis
Legend

Please accept the answer that worked, and move this "answer" to be a comment on that answer.

0 Karma

niketn
Legend

The is not because of Field For Label and Field For Value being the same. They can be the same search field extracted by you. The reason why you are getting duplicates is because you have multiple events with same sourcetype returned. Out of the several ways you should pick anyone to pull only unique sourcetype. For example the following should give unique sourcetype through dedup command.

 <input type="radio" token="sourcetype1">
         <label>Source</label>
                     <search>
                               <query>host=WIKI sourcetype="secure*.log"
| dedup sourcetype
| sort sourcetype
| table sourcetype</query>
                    </search>
         <fieldForLabel>sourcetype</fieldForLabel>
         <fieldForValue>sourcetype</fieldForValue>
 </input>

The purpose of Label and Value fields being different is to allow you to Display something meaningful to users through label and use hidden Value for performing actual search. For example if you search returns AccountName and AccountNumber. You can choose AccountName as Label and AccountNumber as Value.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@LNebout, Kindly accept the answer if this solved the issue you were facing. If not please let me know.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

LNebout
Path Finder

@niketnilay, sorry I had forgot to accept the answer ('^_^)

0 Karma

LNebout
Path Finder

@niketnilay
Works perfectly,
thanks

0 Karma

niketn
Legend

@LNebout ... I think you missed accepting the answer 🙂 You should choose Accept Answer option from bolt icon next to my Answer (only you will have that option since you posted the question).

In any case glad that the issue is actually resolved.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...