There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.
Can someone help me in how I can achieve this?
@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
@niketnilay I have below code. And it still shoes "No result found"
<panel>
<table rejects="$show_html$">
<title>Geographically Improbable Accesses</title>
<searchPostProcess> `uitime(prev_time)`
| table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
<drilldown>
<link>access_search?form.user=$row.user$&earliest=$earliest$&latest=$latest$</link>
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"></unset>
</condition>
</drilldown>
<option name="drilldown">row</option>
<option name="count">5</option>
</table>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
</panel>
@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?
@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.
Just reverse depends and rejects between your table and panel.
Also for debugging the Set/Unset Token Value please change the table title to
<title>Geographically Improbable Accesses ($show_html$)</title>
Also, in HTML section,
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>
If it still does not work, please paste the final code.
@niketnilay
reversing the depends and rejects between table and panel did the trick. Thank you So much for assistance. Now I am able to see the message displayed in
tags.
again, thank you so much.
@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped.
Are you looking to do something like this?
https://answers.splunk.com/answers/124157/timecharts-and-how-to-avoid-no-results-found-inspect.html
Hi somesoni2,
Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".
Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.
Ok. Got it. Thanks