Splunk Search

Why I have "Duplicate values causing conflict" with eval ?

Abarny
Path Finder

Hi,

Can you tell me why i can't update my dynamic list on my dashboard ? I have this message : "Duplicate values causing conflict"

 index="gta_projets" 
|  eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
| dedup acteur 
|top 200 acteur | sort by acteur

Thanks you for your answer,

Tags (2)
0 Karma
1 Solution

niketn
Legend

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Abarny
Path Finder

Thanks for your answer,

I have same probleme, i write like you but I can't take all values in acteur cause it's a concatenation enter firstName and lastName

index="gta_projets"  logs{}.user.firstName="*"  logs{}.user.lastName="*" 
  | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
  | dedup acteur 
  | sort acteur
  | head 25
0 Karma

niketn
Legend

@Abarny, Can you share the XML code for your input?

Do you see something like <choice value="<SomeValue>"><Some Label></choice>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Abarny
Path Finder

It's okay i have puplate my list. Thaks niketnilay

0 Karma

niketn
Legend

@Abarny...Cheers!!! 🙂 I have converted my comment to answer. Please accept to mark this question as answered if this helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...