Splunk Search

Why I have "Duplicate values causing conflict" with eval ?

Abarny
Path Finder

Hi,

Can you tell me why i can't update my dynamic list on my dashboard ? I have this message : "Duplicate values causing conflict"

 index="gta_projets" 
|  eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
| dedup acteur 
|top 200 acteur | sort by acteur

Thanks you for your answer,

Tags (2)
0 Karma
1 Solution

niketn
Legend

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

If you are using the query to populate an input like dropdown, then check that you do not have any static choice created. Seems like one of your acteur returned by query is the same as the static choice you have defined for the input.

Also, if you just need the first 200 acteur, you should consider changing the query as below.

  index="gta_projets" acteur=*
 | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
 | dedup acteur 
 | sort acteur
 | head 200
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Abarny
Path Finder

Thanks for your answer,

I have same probleme, i write like you but I can't take all values in acteur cause it's a concatenation enter firstName and lastName

index="gta_projets"  logs{}.user.firstName="*"  logs{}.user.lastName="*" 
  | eval acteur='logs{}.user.firstName'." ".'logs{}.user.lastName' 
  | dedup acteur 
  | sort acteur
  | head 25
0 Karma

niketn
Legend

@Abarny, Can you share the XML code for your input?

Do you see something like <choice value="<SomeValue>"><Some Label></choice>

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Abarny
Path Finder

It's okay i have puplate my list. Thaks niketnilay

0 Karma

niketn
Legend

@Abarny...Cheers!!! 🙂 I have converted my comment to answer. Please accept to mark this question as answered if this helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...