Splunk Search

Duplicate Values causing Conflict | Can't Fix

kokanne
Communicator

Hey, I'm trying to create a dashboard where there can be multiple entries for a field. There is a report behind my multi-select value on the dashboard.

I have made sure to name everything appropriately and that there are no duplicate fields. My query for the report is:
-snip-

I don't understand why it still says that duplicate values are causing a conflict. The following are my settings in the dashboard:

-snip-

Is there anything that can be done to fix this?

0 Karma
1 Solution

kokanne
Communicator

The answer was changing the label and the value. Besides that I changed the sort to sort 0 - CVE

View solution in original post

0 Karma

kokanne
Communicator

The answer was changing the label and the value. Besides that I changed the sort to sort 0 - CVE

0 Karma

woodcock
Esteemed Legend

Try this (cut and paste so you don't have problems mis-typing whitespace); this assumes that there are no commas in the CVE names:

| inputlookup qualys_kb_lookup 
| makemv delim="," CVE
| mvexpand CVE 
| rex field=CVE mode=sed "s/^[\r\n\s]+// s/[\r\n\s]+$//"
| search CVE= "*" 
| dedup CVE 
| sort 0 - CVE 
| fields CVE
0 Karma

xpac
SplunkTrust
SplunkTrust

Two hints:
The line | search CVE= "*" contains a space, that might cause trouble.
The sort function has an implicit limit of 10000, so you might not get all results. Improve this by using | sort 0 -CVE.

0 Karma

kokanne
Communicator

This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kokanne,

I hope you checked data with Executing search in search bar and no value is duplicated.

Can you please correct in settings.

Field for Label: label
Field for Value: value

to

Field for Label: CVE
Field for Value: CVE

Thanks

kokanne
Communicator

This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...