topic Re: How to add a Custom message in Dashboard panel in replace of "No results found." message? in Dashboards & Visualizations

How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade — Tue, 07 Mar 2017 19:45:55 GMT

There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.

Can someone help me in how I can achieve this?

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

somesoni2 — Tue, 07 Mar 2017 20:10:13 GMT

Are you looking to do something like this?
https://answers.splunk.com/answers/124157/timecharts-and-how-to-avoid-no-results-found-inspect.html

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade — Tue, 07 Mar 2017 20:44:17 GMT

Hi somesoni2,

Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

somesoni2 — Tue, 07 Mar 2017 20:47:41 GMT

Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

niketn — Tue, 07 Mar 2017 20:51:24 GMT

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade — Tue, 07 Mar 2017 21:58:19 GMT

Ok. Got it. Thanks

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade — Tue, 07 Mar 2017 22:19:33 GMT

@niketnilay I have below code. And it still shoes "No result found"

<panel>
  <table rejects="$show_html$">
    <title>Geographically Improbable Accesses</title>
    <searchPostProcess> `uitime(prev_time)`
                        | table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
    <drilldown>
        <link>access_search?form.user=$row.user$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"></unset>
        </condition>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="count">5</option>
  </table>
  <html depends="$show_html$">
      <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>
</panel>

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

niketn — Wed, 08 Mar 2017 06:02:35 GMT

@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade — Wed, 08 Mar 2017 16:54:28 GMT

@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

niketn — Thu, 09 Mar 2017 10:38:02 GMT

Just reverse depends and rejects between your table and panel.

Also for debugging the Set/Unset Token Value please change the table title to

<title>Geographically Improbable Accesses ($show_html$)</title>

Also, in HTML section,

 <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>

If it still does not work, please paste the final code.

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade — Thu, 09 Mar 2017 13:50:58 GMT

@niketnilay

reversing the depends and rejects between table and panel did the trick. Thank you So much for assistance. Now I am able to see the message displayed in

tags.

again, thank you so much.

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

niketn — Thu, 09 Mar 2017 14:05:04 GMT

@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped.