Hey, I'm trying to create a dashboard where there can be multiple entries for a field. There is a report behind my multi-select value on the dashboard.
I have made sure to name everything appropriately and that there are no duplicate fields. My query for the report is:
-snip-
I don't understand why it still says that duplicate values are causing a conflict. The following are my settings in the dashboard:
-snip-
Is there anything that can be done to fix this?
The answer was changing the label and the value. Besides that I changed the sort to sort 0 - CVE
The answer was changing the label and the value. Besides that I changed the sort to sort 0 - CVE
Try this (cut and paste so you don't have problems mis-typing whitespace); this assumes that there are no commas in the CVE names:
| inputlookup qualys_kb_lookup
| makemv delim="," CVE
| mvexpand CVE
| rex field=CVE mode=sed "s/^[\r\n\s]+// s/[\r\n\s]+$//"
| search CVE= "*"
| dedup CVE
| sort 0 - CVE
| fields CVE
Two hints:
The line | search CVE= "*"
contains a space, that might cause trouble.
The sort
function has an implicit limit of 10000, so you might not get all results. Improve this by using | sort 0 -CVE
.
This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.
@kokanne,
I hope you checked data with Executing search in search bar and no value is duplicated.
Can you please correct in settings.
Field for Label: label
Field for Value: value
to
Field for Label: CVE
Field for Value: CVE
Thanks
This works and is populating, but the dashboard gets stuck when I try to put anything in, it doesn't let me enter anything and crashes.