Splunk Search

Why I have "Duplicate values causing conflict" with eval ?

Abarny
Path Finder

Hi,

Can you tell me why i can't update my dynamic list on my dashboard ? I have this message : "Duplicate values causing conflict"

 index="gta_projets" 
|  eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
| dedup acteur 
|top 200 acteur | sort by acteur

Thanks you for your answer,

Tags (2)
0 Karma
1 Solution

niketn
Legend

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Abarny
Path Finder

Thanks for your answer,

I have same probleme, i write like you but I can't take all values in acteur cause it's a concatenation enter firstName and lastName

index="gta_projets"  logs{}.user.firstName="*"  logs{}.user.lastName="*" 
  | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
  | dedup acteur 
  | sort acteur
  | head 25
0 Karma

niketn
Legend

@Abarny, Can you share the XML code for your input?

Do you see something like <choice value="<SomeValue>"><Some Label></choice>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Abarny
Path Finder

It's okay i have puplate my list. Thaks niketnilay

0 Karma

niketn
Legend

@Abarny...Cheers!!! 🙂 I have converted my comment to answer. Please accept to mark this question as answered if this helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...