Splunk Search

Drop-down error "Duplicate values causing conflict" - Dedup not working?

Svill321
Path Finder

Hi everyone,

I'm trying to dynamically populate a dropdown menu with error codes. Obviously, I don't want duplicate values, so I used dedup to remove them:

Error Codes

<panel>
  <input type="dropdown" token="error_tok">
    <label>field1</label>
    <populatingSearch fieldForLabel="name" fieldForValue="name">sourcetype=SOURCE ErrorCode=* |dedup ErrorCode | stats count by ErrorCode</populatingSearch>
    <default>*</default>
  </input>
  <table>
    <search>
      <query>sourcetype=SOURCE ErrorCode=$error_tok$ | table host ErrorCode</query>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
  </table>
</panel>

I am still receiving a duplication error from the drop-down, though. Could someone let me know what I'm doing wrong?

koshyk
Super Champion

I know this is an old post, but just adding a sample

Putting an example to make it simpler

  • good practice to put "_tok" in the token name, so it is not confused with field/label names
  • also try to query wrapped in CDATA just to ensure double quotes, arrow symbols won't cause problems
  • uses "search" rather than the deprecated "populatingSearch" notation
  • and is a working dashboard (to try out)

sample code

<form>
  <label>REMOVE THIS DASHBOARD ANYTIME</label>
  <description>Some Description</description>
  <fieldset autoRun="false">
    <input type="dropdown" token="sourcetype_tok" searchWhenChanged="false">
      <label>label_name</label>
      <choice value="*">All</choice>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
      <query>
        <![CDATA[index=_internal | stats count by sourcetype
        ]]>
      </query>
      <earliest>$timeSpan.earliest$</earliest>
      <latest>$timeSpan.latest$</latest>
      </search>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
    </input>
    <input type="time" token="timeSpan">
      <label>Time Picker</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Event Details</title>
        <search>
          <query>
          <![CDATA[index=_internal sourcetype=$sourcetype_tok$
            | head 1000
            | table _time,index,sourcetype,source,_raw
            ]]>
          </query>
        <earliest>$timeSpan.earliest$</earliest>
        <latest>$timeSpan.latest$</latest>
        </search>
        <option name="count">20</option>
      </table>
    </panel>
  </row>
</form>

rrovers
Communicator

I think you should use fieldForValue="ErrorCode",I think you should use fieldForValue="Errorcode"

Balajiraj
Explorer

I see that you have used fieldForLabel and fieldForvalue have same value. Have u tried changing them as mentioned in below post

https://answers.splunk.com/answers/329960/duplicate-values-causing-conflict.html

adonio
Ultra Champion

try ... | dedup ErrorCode | table ErrorCode
the stats count by ... gives you 2 columns, ErrorCode and count
hope it helps

0 Karma

Svill321
Path Finder

No, still getting the same issue.

0 Karma

adonio
Ultra Champion
<panel>
<input type="dropdown" token="error_tok" searchWhenChanged="true">
      <label>field1</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>ErrorCode</fieldForLabel>
      <fieldForValue>ErrorCode</fieldForValue>
      <search>
        <query>sourcetype=SOURCE ErrorCode=* | fields ErrorCode|dedup ErrorCode |table ErrorCode</query>
        <earliest>-24h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
<table>
     <search>
       <query>sourcetype=SOURCE ErrorCode=$error_tok$ | table host ErrorCode</query>
       <earliest>-4h@m</earliest>
       <latest>now</latest>
     </search>
   </table>
 </panel>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...