topic Re: Dashboard: Replacing default text for empty reports in Splunk Search

Dashboard: Replacing default text for empty reports

AndreasBalster — Thu, 24 Apr 2014 11:50:07 GMT

I'm developing a dashboard to display the results of several saved searches and everything's looking nice.

I just want to change the text output which is shown when a saved search returns an empty result, is it possible?

The definition of my dashboard looks as follows:

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchName>name_of_saved_search_for_report_1</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchName>name_of_save_search_for_report_2</searchName>
    </table>
  </row>
</dashboard>

Re: Dashboard: Replacing default text for empty reports

richgalloway — Thu, 24 Apr 2014 13:08:50 GMT

Here's how we did that in Advanced XML:

<module name="HTML" layoutPanel="panel_row1_col2" autoRun="True">
    <param name="html"><![CDATA[
        <table id="resultsTable">
          <tr><td>foo</td></tr>
        </table>
        <script>
          var rCount = "$results.resultCount$";
          if (rCount == 0) {
            document.getElementById("resultsTable").innerHTML="<h1>Your text here.</h1>";
          }
        </script>
    ]]></param>
</module>

Re: Dashboard: Replacing default text for empty reports

somesoni2 — Thu, 24 Apr 2014 13:48:47 GMT

Try something like this for simple xml

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchString>|savedsearch name_of_saved_search_for_report_1 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchString>|savedsearch name_of_saved_search_for_report_2 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
</dashboard>

Re: Dashboard: Replacing default text for empty reports

AndreasBalster — Fri, 02 May 2014 11:51:00 GMT

Advanced XML seems to have been removed from the 6.x release, so I can't try that... but thanks 🙂

Re: Dashboard: Replacing default text for empty reports

AndreasBalster — Fri, 02 May 2014 11:51:50 GMT

Works nicely, adding a new column with the message. Unfortunately, the other report columns are still in place and I can't seem to get rid of them. Thanks for your input!

Re: Dashboard: Replacing default text for empty reports

richgalloway — Fri, 02 May 2014 12:14:31 GMT

Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro

Re: Dashboard: Replacing default text for empty reports

snaikwade_splun — Thu, 09 Nov 2017 21:13:09 GMT

Did you find the workaround on how to get rid of other columns ?