topic Re: help for displaying a text in a chart panel if no results in Splunk Enterprise

help for displaying a text in a chart panel if no results

jip31 — Fri, 30 Oct 2020 06:45:32 GMT

hello

`weatherevent` | fields host EventCode | eval time = strftime(_time, "%m/%d/%Y %H:%M") | search host=tutu | eval EventCode=case(EventCode==41, "System reboot without cleanly shutting down first", EventCode==10111, "Device offline due to a user-mode driver crash", EventCode==10110, "Problem with ouser-mode drivers") | stats count as ID by EventCode | eval ID=if(isnull(ID),"No critical ID for this host",ID)

I need to display a message in a chart panel if there is no results

I have done it in a eval command but it doesn't works

could you help me please??

Re: help for displaying a text in a chart panel if no results

ITWhisperer — Fri, 30 Oct 2020 07:32:33 GMT

This is a classic case of trying to display something that doesn't exist in your data. The way around this is to add to your data to give splunk something to display. In your case, you need an eventcode for every host you are interested in that doesn't already have an eventcode or another way would be to add a default event code for every host, then overwrite it with the event code for that host from the data.

Re: help for displaying a text in a chart panel if no results

jip31 — Fri, 30 Oct 2020 07:58:39 GMT

it doesnt help me a lot...

something like this?

| stats count as ID by EventCode host | eval ID=if(isnull(ID),"No critical ID for this host",ID)

Re: help for displaying a text in a chart panel if no results

ITWhisperer — Fri, 30 Oct 2020 08:13:39 GMT

Not really. You are still trying to do something for a host that splunk doesn't have any data for. Which hosts do you want these messages for?

Re: help for displaying a text in a chart panel if no results

jip31 — Fri, 30 Oct 2020 09:07:57 GMT

I want this message for hosts that have no eventcode corresponding

it means hosts which have no ID 41, ID 10110 or 10111 events

Re: help for displaying a text in a chart panel if no results

ITWhisperer — Fri, 30 Oct 2020 09:36:19 GMT

Which hosts are they? If there are no events for that host in your data, how does splunk know which hosts you are interested in?

Re: help for displaying a text in a chart panel if no results

jip31 — Fri, 30 Oct 2020 09:58:55 GMT

But I dont need to identify the hostname concerned...

I just need to display a message is there is no event with the related ID......

Re: help for displaying a text in a chart panel if no results

ITWhisperer — Fri, 30 Oct 2020 10:06:18 GMT

You said earlier

| stats count as ID by EventCode host
| eval ID=if(isnull(ID),"No critical ID for this host",ID)

This mentions host. Are you now saying you aren't interested in the host?

Re: help for displaying a text in a chart panel if no results

jip31 — Fri, 30 Oct 2020 12:40:34 GMT

I use a input token in my dashboard

This input coorespond to the hostname I need to check

<input type="text" token="tok_filterhost" searchWhenChanged="true"> <label>Hostname</label> <default>*</default> </input>

If there is not event ID for this host I need to display a message

`weatherevent` | fields host EventCode | search host=$tok_filterhost$ | eval time = strftime(_time, "%m/%d/%Y %H:%M") | eval EventCode=case(EventCode==41, "System reboot without cleanly shutting down first", EventCode==10111, "Device offline due to a user-mode driver crash", EventCode==10110, "Problem with ouser-mode drivers") | stats count as ID by EventCode | eval ID=if(isnull(ID),"No critical ID for this host",ID)