Hi,
I have a dropdown input populated with this search:
index=apache_nifi "info.eventSource"="QDH" | sort 0 headers.ispwebServiceHeader.requestInfo.serviceID | fields headers.ispwebServiceHeader.requestInfo.serviceID | dedup headers.ispwebServiceHeader.requestInfo.serviceID
and with these configurations:
Field For Label: headers.ispwebServiceHeader.requestInfo.serviceID
Field For Value: headers.ispwebServiceHeader.requestInfo.serviceID
But, I always get this error:
"Duplicate values causing conflict"
Also, if values are really unique (I tested the query in a separate search).
I tried with other Answers but with no positive results.
Any ideas?
Thanks a lot.
Hi @piefragn
Try like
index=apache_nifi "info.eventSource"="QDH"
| stats count by headers.ispwebServiceHeader.requestInfo.serviceID
| sort 0 By headers.ispwebServiceHeader.requestInfo.serviceID
Hi @piefragn
Try like
index=apache_nifi "info.eventSource"="QDH"
| stats count by headers.ispwebServiceHeader.requestInfo.serviceID
| sort 0 By headers.ispwebServiceHeader.requestInfo.serviceID
It works, thank you @vnravikumar
Why do you use the stats count instead of the dedup?
I'm newer to Splunk.
Thanks a lot!
It takes less time when compared to dedup