Getting Data In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Duplicate labels causing conflict

Joannelr
Explorer
‎03-13-2015 04:12 AM

I have this problem on my dashboard, "Duplicate labels causing conflict" what would be the cause of this? I have checked that i dont have any duplicated labels.

Thank you

Labels (1)
Labels
Tags (2)
Reply

scottecclestone
New Member
‎05-26-2020 07:59 AM

Your query is returning values for the Label and values for the Value. At least two different Label values correspond to the exact same Value value. That's the issue causing this warning. Your code will still work (hence warning, rather than error.) There are many ways to solve it. In my case it's really the logged records that were wrong, not the Splunk query, so I left it alone but asked for a fix to the logging.

0 Karma
Reply

vcgamesii
Explorer
‎12-20-2015 01:46 PM

This solution worked for me when I had duplicates in the values of a field.

(top was faster than dedup in my case).

https://answers.splunk.com/answers/240661/receiving-a-duplicate-labels-causing-conflict-erro.html

Reply

vcgamesii
Explorer
‎12-20-2015 01:41 PM

This solution worked for me (having duplicate values within a field). https://answers.splunk.com/answers/240661/receiving-a-duplicate-labels-causing-conflict-erro.html

0 Karma
Reply

lisaac
Path Finder
‎12-01-2015 11:32 AM

This solution here worked link text

0 Karma
Reply

tdiestel
Path Finder
‎09-10-2015 03:19 PM

This error will arise when you have a table that has either duplicate "labels" or duplicate "values". Ensure that when you do ...|table fieldA fieldB that fieldA contains unique values and fieldB contains unique values. To do this you could blindly do the below but double check that the outcome is what you want:

...|dedup fieldA| dedup fieldB|table fieldA fieldB

Reply

jeremiahc4
Builder
‎09-09-2015 08:00 AM

Has anyone received an answer to this yet? I'm having the same problem. I'm using an inputlookup that has duplicates in fields I'm not including in my populating search (index, sourcetype, etc...). I'm only including a description field which I'm doing a dedup on in the populating search.

| inputlookup my_lookups | search field1="blah" | dedup description | table description

This search produces a table of 4 distinct values from my_lookups, if I take the table command off the end, I see there are duplicates in various other fields in the lookup.

0 Karma
Reply

edroche3rd
Explorer
‎07-22-2015 02:36 PM

Same Issue as well 6.2.4 Ent

Here is my code:

  <label>NetQoS</label>
  <choice value='None'></choice>
  <search>
    <query>| inputlookup belts.csv</query>
  </search>
  <fieldForLabel>Level</fieldForLabel>
  <fieldForValue>l_val</fieldForValue>
</input>

Input csv only has 5 lines:

White
Orange
Blue
Red
Black

Any thoughts?

Thanks
Ed

Reply

mjones414
Contributor
‎07-08-2015 12:07 PM

Also getting this on every drop down in 6.2.3 using the same xml syntax

Reply

asherman
Path Finder
‎04-13-2015 08:47 AM

I get the same issue using the following snippet:

      <choice value="primary">Primary</choice>

I had no issue using this code in version 6.0.1, I believe. Upgrading to 6.2.1 introduced the 'Duplicate..." error. The event 'primary' is returned by the populating search in the dropdown menu that uses this, and this xml node was used to rename that value.

I don't see why this should raise any flags from the GUI.

0 Karma
Reply

Ozyolcular
New Member
‎04-09-2015 07:11 AM

Similar problem in 6.2.1. In my case Label (EnvName) is unique but Value (EnvId) is duplicate. Splunk shall not report it as "Duplicate labels causing conflict" because there is no conflict..

EnvName

FullInstall

titanium_server_15

and corresponding Values

EnvId

titanium_server_15
titanium_server_15

  <input type="multiselect" token="envIdTok" searchWhenChanged="true">
    <label>Environment/Profile</label>
    <choice value='None'></choice>
    <delimiter> OR </delimiter>
    <valuePrefix>EnvId="</valuePrefix>
    <valueSuffix>"</valueSuffix>
    <search>
      <query>index=eidx RNTid="$rlskey$" | dedup EnvName | table EnvName, EnvId</query>
    </search>
    <fieldForLabel>EnvName</fieldForLabel>
    <fieldForValue>EnvId</fieldForValue>        
    <change>
      <set token="tr">*</set>
      <set token="timeTokLatest">$timeTok.latest$</set>
      <set token="runDateTok">0</set>
    </change>
  </input>

,

0 Karma
Reply

Joannelr
Explorer
‎03-15-2015 11:21 PM

The UID drop down

0 Karma
Reply

somesoni2
SplunkTrust
SplunkTrust
‎03-13-2015 06:44 AM

For which dropdown you're getting duplicate label error?

0 Karma
Reply

Joannelr
Explorer
‎03-13-2015 05:53 AM 
<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="staff_email" searchWhenChanged="true">
  <label>Email</label>
  <choice value="*">All</choice>
  <search>
    <query>|sort dataa_alias|table dataa_alias</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>dataa_alias</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="gadget_os" searchWhenChanged="true">
  <label>gadget OS</label>
  <choice value="*">All</choice>
  <search>
    <query>| tstats count from datamodel=switch_dm where ( nodename=switch._switch_ping ) AND  (switch.dataa_alias=*)  GROUPBY  switch.gadget_os|sort switch.gadget_os|table switch.gadget_os</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>switch.gadget_os</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="phone" searchWhenChanged="true">
  <label>Phone</label>
  <choice value="*">All</choice>
  <search>
    <query>| tstats count from datamodel=switch_dm where ( nodename=switch.switch_ping ) AND  (switch.dataa_alias=*)  GROUPBY  switch.sd_name|sort switch.sd_name|table switch.sd_name</query>
    <earliest>-7d@h</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>switch.sd_name</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="team" searchWhenChanged="true">
  <label>Team</label>
  <choice value="*">All</choice>
  <choice value="null">Null</choice>
  <search>
    <query>|inputlookup|dedup Team|sort Team|table Team</query>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>Team</fieldForValue>
  <default>*</default>
</input>
<input type="dropdown" token="uid" searchWhenChanged="true">
  <label>UID</label>
  <search>
    <query>| inputlookup |sort data_uid|table data_uid</query>
  </search>
  <fieldForLabel>data_uid</fieldForLabel>
  <fieldForValue>data_uid</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
</input>


<panel>
  <table>
    <title>Pivot Report - By Staff</title>
    <search>
      <query>| tstats count from datamodel=switch_dm where ( nodename=switch._switch_ping ) AND  (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY   _time span=1d switch.dataa_alias|lookup_switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS  dataa_alias|lookup staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$" |eval "Date" = strftime(_time, "%F %T")|rename dataa_alias As Email |chart limit=30 values(count) by Email,Date</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <drilldown>
      <set token="staff_email">$row.Email$</set>
      <set token="form.staff_email">$row.Email$</set>
    </drilldown>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">heatmap</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>
<panel>
  <table>
    <title>Pivot Report - By Team</title>
    <search>
      <query>| tstats count from datamodel= switch_dm where ( nodename= switch. switch_ping ) AND  (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY   _time span=1d switch.dataa_alias|lookup switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS  dataa_alias|lookup _staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$"  |eval "Date" = strftime(_time, "%F %T")|rename switch.dataa_alias As Email | chart limit=30 sum(count) by Team,Date</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <drilldown>
      <set token="team">$row.Team$</set>
      <set token="form.team">$row.Team$</set>
    </drilldown>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>


<panel>
  <chart>
    <title>Staff Chart</title>
    <search>
      <query>| tstats count from datamodel=switch_dm where ( nodename=switch.switch_ping ) AND  (switch.dataa_alias=$staff_email$) (switch.gadget_os="$gadget_os$") (switch.sd_name="$phone$") NOT ("switch.dataa_alias"=unknown) GROUPBY   _time  switch.dataa_alias|lookup switch.dataa_alias OUTPUT Name Team|fillnull value=null Team|search Team="$team$" |rename switch.dataa_alias AS  dataa_alias|lookup _staff_lookup dataa_alias OUTPUT data_uid|search data_uid="$uid$"  |rename switch.dataa_alias As Email |timechart values(count) by Email limit=30</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">false</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">column</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.style">shiny</option>
0 Karma
Reply

ngatchasandra
Builder
‎03-13-2015 05:01 AM

Can you post your xml code?

0 Karma
Reply
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...