How do I display "no data found" message when ther...

smuppava · ‎10-25-2016

How do I display message to the user saying "No data found" on the dashboard panel when each of the panels returns no data at all. Currently, I am hiding panels when no search results are displayed for the dashboard. So, my dashboard shows as blank when no data is been returned.

I would like to display a user friendly message to the user saying "No data found" when all the panels in my dashboard returns no results.

Thx for your help,
Sirisha

lquinn · ‎10-25-2016

Is your dashboard in XML or HTML?

gcusello · ‎10-25-2016

Hi smuppava,
You could see an example in Dashboard Examples app (you can download it from appbase https://splunkbase.splunk.com/app/1603/), showing an html message instead of "No data found".
something like this

  <search id="search_logic">
    <query>
      mysearch
    </query>
    <!-- Progress event has access to job properties only -->
    <progress>
      <condition match="'job.resultCount' == 0">
        <set token="show_html">foob</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <chart rejects="$show_html$">
        <title>XXXXXXXXXXXXXXXXXXXXXXXXXX</title>
        <search>
          <query>
              myquery
          </query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <set token="count">$job.eventCount$</set>
          </progress>
          <cancelled>
            <unset token="count"></unset>
          </cancelled>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </chart>
      <html depends="$show_html$">
        <p style="color:red;margin-left:30px;font-size:24px">BEWARE:</p>
        <br/>
         <p style="color:blue;margin-left:30px;font-size:24px">message</p>
         <p style="color:blue;margin-left:30px;font-size:24px">message</p>
      </html>
    </panel>

Bye.
Giuseppe

cmerriman · ‎10-25-2016

i just helped someone with this the other day

https://answers.splunk.com/answers/467823/if-there-are-no-results-found-how-do-i-get-my-sear.html#an...

use | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]

smuppava · ‎10-25-2016

I incorporated the above code into my query. But didn't work.

cmerriman · ‎10-25-2016

try placing the append at the very end.

index=eapi_cloud_system_qa id-swiftid-green-ITE-app sourcetype=monitor OR sourcetype=monitor_log|rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P[\w]+)" | rex field=_raw "(Host-ProcessCPUUtilization-Percent)[\w | ^:](?P[\w]+)" |chart values(ec2cpu) as EC2_CPUUtilization values(processcpu) AS Process_CPUUtilization by _time span=1m | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]

smuppava · ‎10-25-2016

The above query given results in a row being displayed with 3 columns and 1 column displays no data found

skoelpin · ‎10-25-2016

You will need to use a webhook

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Webhooks

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Alertexamples

smuppava · ‎10-25-2016

This doesn't help!

How do I display "no data found" message when there are no search results displayed for each dashboard panel?

Introducing Splunk Enterprise 9.2

Adoption of RUM and APM at Splunk

Routing logs with Splunk OTel Collector for Kubernetes