Splunk Search

Query is getting error Duplicate values causing conflict

teddyidc1101
Communicator

I have this data
Owner Branch# Bname
O1 B1 Bname1
O1 B2 Bname2
O2 B1 Bname3
O2 B3 Bname4
O2 B4 Bname5
O3 B3 Bname6
O3 B5 Bname7

I need to put the Bname in a dropdown where depending on the Owner (token) but the query is getting error Duplicate values causing conflict because of the multiple Branch#. I cannot dedup Branch# as this will be passed on as token to other panels when owner is chosen. If I do dedup, it will only pass the 1st occurence and other owner will not have any Branch# to chose from.

Any idea on how to manage the SPL?
Thanks!

0 Karma

Vijeta
Influencer

When its passed as token to other panels along with the Owner , there should be no impact of deleting duplicate branch number in your input query as your selection from lookup or index will be based on combination of branch# and Owner. Can you please paste your code so it will be easy to understand the question.

0 Karma

teddyidc1101
Communicator

During the initial load of the dropdown values, there's a duplicate error since there are multiple branch# (Owner=* and branch#=*). when a specific Owner is chosen, then the error disappears as it already has value for branches.

0 Karma

teddyidc1101
Communicator

Here is the sample code for the dropdown:

>   <input type="dropdown"
> token="report"
> searchWhenChanged="true">
>         <label>Report Type</label>
>         <fieldForValue>foo</fieldForValue>
>         <search>
>           <query>| inputlookup foo.csv  | sort foo foo_label | where
> report_label="foo" 
>         </search>
>         <change>
>           <set token="foolabel">$label$</set>
>         </change>
>         <fieldForLabel>foo_label</fieldForLabel>
>         <default>foo</default>
>         <initialValue>foo</initialValue>
>       </input>
>       <input type="dropdown" token="foo2_id"
> searchWhenChanged="true">
>         <label>Foo2</label>
>         <fieldForLabel>foo_NM</fieldForLabel>
>         <fieldForValue>foo2_ID</fieldForValue>
>         <search base="foo2_metadata">
>           <query>| dedup foo2_ID | fields foo_NM foo2_ID  | sort
> foo_NM</query>
>         </search>
>         <change>
>           <set token="foo2_label">$label$</set>
>         </change>
>         <choice value="*">ALL</choice>
>         <default>*</default>
>         <initialValue>*</initialValue>
>       </input>
>       <input type="dropdown" token="foo3" searchWhenChanged="true">
>         <label>Branch</label>
>         <choice value="*">ALL</choice>
>         <fieldForLabel>foo3_NM</fieldForLabel>
>         <fieldForValue>foo3_NO</fieldForValue>
>         <search base="foo3_metadata">
>          <query>| dedup foo3_NO | search foo3_ID="$foo2_id$" | fields
> foo3_NM foo3_NO  | sort foo3_NM
>         </search>
>         <default>*</default>
>       </input>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...