Dashboards & Visualizations

How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade
Path Finder

There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.

Can someone help me in how I can achieve this?

0 Karma
1 Solution

niketn
Legend

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SNaikwade
Path Finder

@niketnilay I have below code. And it still shoes "No result found"

<panel>
  <table rejects="$show_html$">
    <title>Geographically Improbable Accesses</title>
    <searchPostProcess> `uitime(prev_time)`
                        | table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
    <drilldown>
        <link>access_search?form.user=$row.user$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"></unset>
        </condition>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="count">5</option>
  </table>
  <html depends="$show_html$">
      <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>
</panel>
0 Karma

niketn
Legend

@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SNaikwade
Path Finder

@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.

0 Karma

niketn
Legend

Just reverse depends and rejects between your table and panel.

Also for debugging the Set/Unset Token Value please change the table title to

<title>Geographically Improbable Accesses ($show_html$)</title>

Also, in HTML section,

 <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>

If it still does not work, please paste the final code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SNaikwade
Path Finder

@niketnilay

reversing the depends and rejects between table and panel did the trick. Thank you So much for assistance. Now I am able to see the message displayed in

tags.

again, thank you so much.

0 Karma

niketn
Legend

@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma

SNaikwade
Path Finder

Hi somesoni2,

Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.

0 Karma

SNaikwade
Path Finder

Ok. Got it. Thanks

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...