Splunk Search

Null Search Swapper

jebabin
Engager

Hello,

When using the "Null Search Swapper" functionality with code like the one we can find in the "Splunk 6.x Dashboard Examples" app
( /en-US/app/simple_xml_examples/null_search_swapper?form.index_switcher=index%3D_internal&earliest=0&latest= )

So:

<progress>
            <condition match="$job.resultCount$ == 0">
              <set token="show_html">foob</set>
            </condition>
            <condition>
              <unset token="show_html"/>
            </condition>
          </progress>
        </search>
      <chart rejects="$show_html$">
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
      </html>

The HTML part is displayed until the search finish and return something (if it return something). Is there a way to show the html only when the search is finished and nothing has been found ?

My problem is that I've some search taking several seconds, and if user don't wait, they may think there is no result and close the page. They don't have anything to see that the query is in progress

0 Karma
1 Solution

niketn
Legend

Can you please try these couple of options?

1) Change from <progress> to <done> search event handler. All other code remains the same.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#done

2) In your existing search change condition from match="$job.resultCount$ == 0" to match="$job.resultCount$ >0"
and swap the depends and reject between chart and html panel i.e.
<chart rejects="$show_html$"> and <html depends="$show_html$">

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Can you please try these couple of options?

1) Change from <progress> to <done> search event handler. All other code remains the same.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#done

2) In your existing search change condition from match="$job.resultCount$ == 0" to match="$job.resultCount$ >0"
and swap the depends and reject between chart and html panel i.e.
<chart rejects="$show_html$"> and <html depends="$show_html$">

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jebabin
Engager

Thanks, is what I was missing, thanks for the doc link that I had not found!

0 Karma

niketn
Legend

@jababin...Glad that it worked 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...