Why does my drop-down say "Duplicate values causing conflict" when there are no duplicate values?

[SJanasek]

I am trying to output the CUSTOMER_NAME via a csv lookup. my lookup file (lookup_test.csv) looks like that:

CUSTOMER_ID,CUSTOMER_NAME
39076,Customer1
56706,Customer2
20294,Customer3

my drop-down includes the following search string:

index="index1" sourcetype="source1" | lookup kunde_test  CUSTOMER_ID OUTPUT CUSTOMER_NAME | top 10 CUSTOMER_NAME

it now shows the following message: "Duplicate values causing conflict"

but there are not any duplicate values? what could be the problem here?

[Sukisen1981]

if you need just the customer_name in the drop down, why not use something like this?

 index="index1" sourcetype="source1" | lookup kunde_test  CUSTOMER_ID OUTPUT CUSTOMER_NAME | top 10 CUSTOMER_NAME dedup CUSTOMER_NAME | table CUSTOMER_NAME

[MichaelMcAleer]

I wanted to add in alternative answer to this solution, the whole time I have been adding the drill down filters using source XML instead of the UI, from the source XML and query run everything looked fine there were no duplicates so I was lead to searching online for answers. The "Field for Label" or "Field for Value" were fine, no different from the examples shown in the dashboard examples app, but when I looked at the filter in UI mode I noticed that there were two 'ALL = ' key/value pairs listed whereas there wasn't in the source XML. Removed the second 'All=' option and cleared the 'duplicate values causing conflict error'

[claudio_manig]

This is often caused by using the wrong values in "Field for Label" or "Field for Value" - in my case i used the splunk field name there and not the original one out of the lookup

[dbray_sd]

Could you explain a little further? Maybe some examples? I think this is the exact problem I'm having, but not really understanding what Splunk wants for this simple dropdown.

[claudio_manig]

Its kind of shaky if you ask me as i often experienced this problem - try to check you field for value and field for label entries and check wheter they are set correct.

[jplumsdaine22]

You're missing the initial <input> tag, but otherwise it looks OK. Are you sure there are no duplicate values for CUSTOMER_NAME in kunde_test ? run

| inputlookup kunde_test | stats count by CUSTOMER_NAME | where count > 1 

to be sure

[SJanasek]

just forgot to copy it
input type="dropdown" token="kunde" searchWhenChanged="true"

and no, there aren't duplicate values, tested it

[jplumsdaine22]

Hopefully someone else can help - the only other thing I can think is that you may have another token called kunde on the same dashboard

[jplumsdaine22]

Can you post the xml of your dropdown?

[SJanasek]

  <label>Kunde</label>
  <search>
    <query>index="index1" sourcetype="source1" | lookup kunde_test CUSTOMER_ID OUTPUT CUSTOMER_NAME | top 10 CUSTOMER_NAME</query>
    <earliest>0</earliest>
    <latest></latest>
  </search>
  <fieldForLabel>CUSTOMER_NAME</fieldForLabel>
  <fieldForValue>CUSTOMER_NAME</fieldForValue>
</input>

[cmerriman]

Are you sure that no customers have the exact same name? I see that warning sometimes when I use name because two people will end up having a very common name. I changed the query, in my case, to either limit the names I cared about if it was bringing back people I didn't need, or I used the ID for the value, and I think that solved it.

[SJanasek]

Yes, I am sure, they are not even similar at all.

[cmerriman]

Then the only other thing I could think of could be that the percentages in the top command are coming back the same. try adding a |fields CUSTOMER_NAME to the end of the query.