Dynamic Dropdown duplicate values showing

[dbcase]

Hi,

I have this code

<input type="dropdown" token="mso_selection">
      <label>Select a MSO</label>
      <search>
        <query>index=wholesale_app|dedup buildTarget|sort buildTarget</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>buildTarget</fieldForLabel>
      <fieldForValue>buildTarget</fieldForValue>
    </input>

It will dynamically populate a dropdown list with company names. Right now I only have "Freds Fish Market" in the data and the drop down shows that as one entry but it also shows Freds Fish Market,Freds Fish Market as a second entry at the bottom of the dropdown list. And it is selectable. What am I doing wrong ?

[niketn · Accepted solution]

@dbcase, surprisingly it should work. However, we can try some of the things to check

Does the following search in Splunk Search Bar give you one row or two rows for buildTarget?

 index=wholesale_app
| dedup buildTarget
| sort buildTarget 
| table buildTarget

Can you try a different approach with stats or head instead of dedup just to check, also try base filters including sourcetype if there is single sourcetype for this data?

 index="wholesale_app" sourcetype="<YourSourceType>" buildTarget=*
| stats count by buildTarget
| fields buildTarget 
| sort buildTarget

Or since you have single value for buildTarget

 index="wholesale_app" sourcetype="<YourSourceType>" buildTarget=*
 | head 1
 | table buildTarget

Your code does not show static <choice>, default value or initial value. Hope you don't have one. After editing dashboard have your tried closing out and reloading the dashboard in new window? Or may be remove form values from the query string on default dashboard load?
Can you also let us know your Splunk version? You should meanwhile also open a Splunk support ticket.

[dbcase]

Well, I "fixed" it...... more like smashed it with a boulder

this query did the trick, still can't figure out why there appears to be duplicate in the data when there isnt.....

index=wholesale_app|dedup buildTarget|eval stringlen=len(buildTarget)|where stringlen<10|sort buildTarget

[niketn]

@dbcase, there is definitely something "fishy"... and still it is "hilarious ;)"

If both stats and dedup would have given two rows I would have suspected data, but seems like confined to dedup.

Do you mind trying out another query? Also providing your Splunk Enterprise version?

index=wholesale_app
| dedup buildTarget
| table _time _raw buildTarget

Inspect the raw event and buildTarget field as to why buildTarget name appears twice in the same event. If you have created field extraction for buildTarget. Please test the regular expression with sample data on regex101.com to ensure field extraction is working fine or not.

[dbcase]

Hi Niketnilay,

Good to know there is someone who appreciates bad humor 🙂

here is the results of your query

_time   _raw    buildTarget
2017-11-17 14:06:47 {"analyticType":"Counter","buildTarget":"Freds Fish Market","clientSessionId":"DXDKOYP-AWPEOUC","Properties":{"index":12,"args":[2],"category":"Event"}}    
Freds Fish Market
Freds Fish Market
2017-11-16 13:55:52 {"analyticType":"Counter","buildTarget":"Freds Fish Market","clientSessionId":"DXDEPQ-AOZUGSD","Properties":{"index":13,"args":[66],"category":"Event"}}    comcast

Another query gives the expected results

index=wholesale_app  sourcetype=wholesale_mobile_app | spath buildTarget  | dedup buildTarget

[niketn]

@dbcase, so I expect your KV_MODE and/or INDEXED_EXTRACTION modes are json in your props.conf. This seems to be problem with search time default field discovery. You should definitely report this Splunk as to why stats is working and dedup is not.

PS: If | spath is working you can use that.

I would also request you to un-accept my answer and Accept your previous comment as the answer. You can definitely up vote the comments that helped.

[dbcase]

Hi Niketnilay,

Wow lots of things to try.... ok here goes

On the first one I get two rows

1st row = Freds Fish Market
2nd row= Freds Fish Market Freds Fish Market

The above makes me suspect I have a fishy (sorry bad pun) record in my data set

The second one yields only 1 row (but it takes a while)
1st and only row=Freds Fish Market

I didn't try the 3rd one as there will be other customers in the drop down eventually

[deepashri_123]

Hi dbcase,

You can try the following query:
index=wholesale_app|dedup buildTarget|table buildTarget

[dbcase]

Hi deepashri_123

I tried what you suggested

<input type="dropdown" token="mso_selection">
          <label>Select a MSO</label>
          <search>
            <query>index=wholesale_app|dedup buildTarget|table buildTarget</query>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
          </search>
          <fieldForLabel>buildTarget</fieldForLabel>
          <fieldForValue>buildTarget</fieldForValue>
        </input>

And I still have the same problem (although the order of the dropdown has changed)

[dbcase]

I suspect the problem lies in the fieldforlabel/fieldforvalue but I don't know what changes need to be made

[deepashri_123]

Hi dbcase,

You can try the following query:
index=wholesale_app|dedup buildTarget|table buildTarget