Splunk Search

How to do error handling for wrong search query in HTML view

jsharma123
Explorer

HI ,

I have a html dashboard which update a d3 graph on text input change ,
This text input is added to my search query in search manager.
But when The query is wrong or there is no data , I need to do error handling .
How can i check for this situation ?

Tags (3)
0 Karma
1 Solution

jsharma123
Explorer

I found a solution

This is what I did

search.on("search:done", function(state,job) {
           if(state.content.resultCount==0){
                d3.select("#body").select("svg").remove();

                var newSvg= d3.select("#body").append("svg")
                .attr("width", width + margin.right + margin.left)
                .attr("height", height + margin.top + margin.bottom);

                var rect = newSvg.append('rect').transition().duration(10).attr('width', 1050)
                .attr('height', 50)
                .attr('x', 40)
                .attr('y', 100)
                .style('fill', 'white')
                var text = newSvg.append('text').text('The query returned No result')
                .attr('x', 50)
                .attr('y', 150)
                .attr('fill', 'black')
                .attr("font-family", "sans-serif")
                .style("font-size", "34px");
           }
         });

var myResults =search.data('results', { // get the data from that search
                     output_mode: 'json_rows',
                     count: 0 // get all results
                 });

myResults.on("data", function() {

    console.log("Has data? ", myResults.hasData());

}

View solution in original post

jsharma123
Explorer

I found a solution

This is what I did

search.on("search:done", function(state,job) {
           if(state.content.resultCount==0){
                d3.select("#body").select("svg").remove();

                var newSvg= d3.select("#body").append("svg")
                .attr("width", width + margin.right + margin.left)
                .attr("height", height + margin.top + margin.bottom);

                var rect = newSvg.append('rect').transition().duration(10).attr('width', 1050)
                .attr('height', 50)
                .attr('x', 40)
                .attr('y', 100)
                .style('fill', 'white')
                var text = newSvg.append('text').text('The query returned No result')
                .attr('x', 50)
                .attr('y', 150)
                .attr('fill', 'black')
                .attr("font-family", "sans-serif")
                .style("font-size", "34px");
           }
         });

var myResults =search.data('results', { // get the data from that search
                     output_mode: 'json_rows',
                     count: 0 // get all results
                 });

myResults.on("data", function() {

    console.log("Has data? ", myResults.hasData());

}

niketn
Legend

@jsharma123, this is elegant. You can go ahead and accept your own answer to mark this question as answered!

In Splunk there are depends and rejects attributed which allow you to show or hide a dashboard element based on whether the token is set or not. You can refer to Null Search Swapper example in Splunk Dashboard examples app to see how that works in Simple XML and then convert the same to HTML as per your need. Since it is in similar lines with what you have already done in svg, I will let it up to you whether you want that solution 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@jsharma123, what is the error handling you need to perform?

1) Hide D3 visualization on Error or No Results.
2) Handle No Results with your Template output like "No Results Found. Please change the filter criteria."
3) Perform Text Box input Regular Expression based validation to allow only valid input
4) Invoke JavaScript based code for custom Error Handling

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jsharma123
Explorer

@niketnilay

Thanks for your reply,
I want to do "Handle No Results with your Template output like "No Results Found. Please change the filter criteria."
and as follow up action it should "Hide D3 visualization on Error or No Results."

I am using

var myResults =search.data('results', { // get the data from that search
                    output_mode: 'json_rows',
                     count: 0 // get all results
                 });

This will not even get called in case of no data.

I am looking at Search:done as well but then how to get my data when result has data?

myResults.on("search:done", function() {
   console.log("Woohoo, all done!");
 });
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...