Splunk Search

How to do error handling for wrong search query in HTML view

jsharma123
Explorer

HI ,

I have a html dashboard which update a d3 graph on text input change ,
This text input is added to my search query in search manager.
But when The query is wrong or there is no data , I need to do error handling .
How can i check for this situation ?

Tags (3)
0 Karma
1 Solution

jsharma123
Explorer

I found a solution

This is what I did

search.on("search:done", function(state,job) {
           if(state.content.resultCount==0){
                d3.select("#body").select("svg").remove();

                var newSvg= d3.select("#body").append("svg")
                .attr("width", width + margin.right + margin.left)
                .attr("height", height + margin.top + margin.bottom);

                var rect = newSvg.append('rect').transition().duration(10).attr('width', 1050)
                .attr('height', 50)
                .attr('x', 40)
                .attr('y', 100)
                .style('fill', 'white')
                var text = newSvg.append('text').text('The query returned No result')
                .attr('x', 50)
                .attr('y', 150)
                .attr('fill', 'black')
                .attr("font-family", "sans-serif")
                .style("font-size", "34px");
           }
         });

var myResults =search.data('results', { // get the data from that search
                     output_mode: 'json_rows',
                     count: 0 // get all results
                 });

myResults.on("data", function() {

    console.log("Has data? ", myResults.hasData());

}

View solution in original post

jsharma123
Explorer

I found a solution

This is what I did

search.on("search:done", function(state,job) {
           if(state.content.resultCount==0){
                d3.select("#body").select("svg").remove();

                var newSvg= d3.select("#body").append("svg")
                .attr("width", width + margin.right + margin.left)
                .attr("height", height + margin.top + margin.bottom);

                var rect = newSvg.append('rect').transition().duration(10).attr('width', 1050)
                .attr('height', 50)
                .attr('x', 40)
                .attr('y', 100)
                .style('fill', 'white')
                var text = newSvg.append('text').text('The query returned No result')
                .attr('x', 50)
                .attr('y', 150)
                .attr('fill', 'black')
                .attr("font-family", "sans-serif")
                .style("font-size", "34px");
           }
         });

var myResults =search.data('results', { // get the data from that search
                     output_mode: 'json_rows',
                     count: 0 // get all results
                 });

myResults.on("data", function() {

    console.log("Has data? ", myResults.hasData());

}

niketn
Legend

@jsharma123, this is elegant. You can go ahead and accept your own answer to mark this question as answered!

In Splunk there are depends and rejects attributed which allow you to show or hide a dashboard element based on whether the token is set or not. You can refer to Null Search Swapper example in Splunk Dashboard examples app to see how that works in Simple XML and then convert the same to HTML as per your need. Since it is in similar lines with what you have already done in svg, I will let it up to you whether you want that solution 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@jsharma123, what is the error handling you need to perform?

1) Hide D3 visualization on Error or No Results.
2) Handle No Results with your Template output like "No Results Found. Please change the filter criteria."
3) Perform Text Box input Regular Expression based validation to allow only valid input
4) Invoke JavaScript based code for custom Error Handling

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jsharma123
Explorer

@niketnilay

Thanks for your reply,
I want to do "Handle No Results with your Template output like "No Results Found. Please change the filter criteria."
and as follow up action it should "Hide D3 visualization on Error or No Results."

I am using

var myResults =search.data('results', { // get the data from that search
                    output_mode: 'json_rows',
                     count: 0 // get all results
                 });

This will not even get called in case of no data.

I am looking at Search:done as well but then how to get my data when result has data?

myResults.on("search:done", function() {
   console.log("Woohoo, all done!");
 });
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...