I've created a dashboard with a drop down so the user can select different sources. But I'm receiving a "Duplicate labels causing conflict" error, how do I stop this.
I've already read the post listed here:
http://answers.splunk.com/answers/221599/duplicate-labels-causing-conflict.html
but this didn't resolve my issue.
Here's my XML code:
<form>
<label>TEST</label>
<description>description</description>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="source" searchWhenChanged="true">
<label>Select a Source:</label>
<search>
<query>index="test_inputs" sourcetype="Qualys_Desktop" source="*-MS-*" | fields source</query>
<earliest>-6mon</earliest>
<latest>now</latest>
</search>
<fieldForLabel>source</fieldForLabel>
<fieldForValue>source</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<single>
<title>Total </title>
<search>
<query>index="test_inputs" source="$source$" Type="Vuln" | stats count</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="linkView">search</option>
</single>
</panel>
<panel>
<single>
<title>Total unique</title>
<search>
<query>index="test_inputs" source="$source$" Type="Vuln" | stats distinct_count(Title)</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="drilldown">none</option>
<option name="linkView">search</option>
</single>
</panel>
</row>
</form>
Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top
to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table
and dedup
.
Did you run the search that populates your dropdown by hand, and if yes what does it return? Maybe there are indeed sources with the same name. I would reccommend to use searches with top
to populate dropdowns, because that way you get rid of duplicates and it should be faster than a combination of table
and dedup
.
Thanks very much, I altered my search so it included a top, it's more efficient too:
index="test_inputs" sourcetype="Qualys_Desktop" source="-MS-" | fields source | top source limit=15
Finally, the fields source
in that search is unnecessary - top
on its own already returns only the source field 🙂
Hello jeffland,
So, I'm having the same problem with my search criteria as well. So, i was wondering if you could help out.
For some reason - I get the same "duplicate values appearing" for some reason.Not sure what i'm doing wrong.
here is my xml for your perusal:
User Activity
Utilization by user activities
<input type="dropdown" token="user" searchWhenChanged="true">
<label>User_Activity_by_Time</label>
<search>
<query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1 | search user!="NULL" | top 0 user </query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
<choice value="*">All</choice>
<default>*</default>
</input>
<input type="time" searchWhenChanged="true">
<label></label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<panel>
<title>User Activity: $user$</title>
<chart>
<search>
<query>| pivot File_Server_Accessibility EventObject count(user) AS "Count of user" SPLITROW _time AS _time PERIOD minute SPLITCOL user FILTER user is * SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 50 SHOWOTHER 1 </query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Tx IN GBps</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">false</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">area</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">zero</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.axisTitleY.text">number of loggers</option>
</chart>
</panel>
That's strange, top
should not return duplicate values. Have you had a look and run the search manually?
Thanks very much