Solved: How to add a Custom message in Dashboard panel in ...

SNaikwade · ‎03-07-2017

There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.

Can someone help me in how I can achieve this?

niketn · ‎03-07-2017

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn · ‎03-07-2017

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SNaikwade · ‎03-07-2017

@niketnilay I have below code. And it still shoes "No result found"

<panel>
  <table rejects="$show_html$">
    <title>Geographically Improbable Accesses</title>
    <searchPostProcess> `uitime(prev_time)`
                        | table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
    <drilldown>
        <link>access_search?form.user=$row.user$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"></unset>
        </condition>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="count">5</option>
  </table>
  <html depends="$show_html$">
      <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>
</panel>

niketn · ‎03-07-2017

@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SNaikwade · ‎03-08-2017

@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.

niketn · ‎03-09-2017

Just reverse depends and rejects between your table and panel.

Also for debugging the Set/Unset Token Value please change the table title to

<title>Geographically Improbable Accesses ($show_html$)</title>

Also, in HTML section,

 <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>

If it still does not work, please paste the final code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SNaikwade · ‎03-09-2017

@niketnilay

reversing the depends and rejects between table and panel did the trick. Thank you So much for assistance. Now I am able to see the message displayed in

tags.

again, thank you so much.

niketn · ‎03-09-2017

@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

somesoni2 · ‎03-07-2017

Are you looking to do something like this?
https://answers.splunk.com/answers/124157/timecharts-and-how-to-avoid-no-results-found-inspect.html

SNaikwade · ‎03-07-2017

Hi somesoni2,

Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".

somesoni2 · ‎03-07-2017

Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.

SNaikwade · ‎03-07-2017

Ok. Got it. Thanks

How to add a Custom message in Dashboard panel in replace of "No results found." message?

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases