Duplicate Values causing Conflict | Can't Fix

[kokanne]

Hey, I'm trying to create a dashboard where there can be multiple entries for a field. There is a report behind my multi-select value on the dashboard.

I have made sure to name everything appropriately and that there are no duplicate fields. My query for the report is:
-snip-

I don't understand why it still says that duplicate values are causing a conflict. The following are my settings in the dashboard:

-snip-

Is there anything that can be done to fix this?

[kokanne · Accepted solution]

The answer was changing the label and the value. Besides that I changed the sort to sort 0 - CVE

[woodcock]

Try this (cut and paste so you don't have problems mis-typing whitespace); this assumes that there are no commas in the CVE names:

| inputlookup qualys_kb_lookup 
| makemv delim="," CVE
| mvexpand CVE 
| rex field=CVE mode=sed "s/^[\r\n\s]+// s/[\r\n\s]+$//"
| search CVE= "*" 
| dedup CVE 
| sort 0 - CVE 
| fields CVE

[xpac]

Two hints:
The line | search CVE= "*" contains a space, that might cause trouble.
The sort function has an implicit limit of 10000, so you might not get all results. Improve this by using | sort 0 -CVE.

[kokanne]

This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.

[kamlesh_vaghela]

@kokanne,

I hope you checked data with Executing search in search bar and no value is duplicated.

Can you please correct in settings.

Field for Label: label
Field for Value: value

to

Field for Label: CVE
Field for Value: CVE

Thanks

[kokanne]

This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.