topic Timechart - Replace "No Results Found" with "No Activity for Today" in Splunk Search

Timechart - Replace "No Results Found" with "No Activity for Today"

TheJagoff — Wed, 19 Jul 2017 14:12:45 GMT

Hello (again),

To go along with my previous question regarding using span=10 minutes using the following search:
index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count |reverse

I'm using "today" in the time-picker

This works fine with searches that have data for today. However; some of my searches do not have any activity for today, so the search comes up with "No Results Found".

I would like to replace "No Results Found" with "No Activity for Today". Is this possible and how is this done?
Again, many thanks!

Re: Timechart - Replace "No Results Found" with "No Activity for Today"

rjthibod — Wed, 19 Jul 2017 14:24:49 GMT

This question is a duplicate of this one: https://answers.splunk.com/answers/129774/change-no-results-found-message.html

That question hasn't been answered, but I am pretty sure the answer is no, or at least, not directly.

The HTML text is not defined in any way that is easily changed via CSS.

Instead, you can add a message block to your SimpleXML that you can control. Here is the generic pattern you can use in SimpleXML

<html depends="$search_msg$">
  <h3 style="margin: 60px 0 50px 10px;">$search_msg$</h3>
</html>
<chart rejects="$search_msg$">
  <search>
    <query>
       index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count |reverse
    </query>
    <done>
      <condition match="'job.resultCount' > 0">
        <unset token="search_msg"/>
      </condition>
      <condition>
        <set token="search_msg">No Activity Found</set>
      </condition>
    </done>          
  </search>
  ...
</chart>

Re: Timechart - Replace "No Results Found" with "No Activity for Today"

TheJagoff — Wed, 19 Jul 2017 15:29:29 GMT

This is exactly what I wanted. Thank you!