Hi,
I am running real time search as dashboard and when there are no logs I got "waiting for data". Is it possible to change the source XML file and display for example "no events "?
<form>
<label>textinput</label>
<init>
<set token="text">"Not in your data"</set>
</init>
<fieldset submitButton="true">
<input type="text" token="text">
<label>Enter Value</label>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Results of $text$</title>
<search>
<query>|makeresults | eval user ="Hari" |eval report="send mail to secure" |append [|makeresults | eval user ="PEPITO" |eval report="Failure"] |fields - _time |where user=$text$ |appendpipe [|stats count as user |where user=0 |eval user="No Results"] </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
<form>
<label>textinput</label>
<init>
<set token="text">"Not in your data"</set>
</init>
<fieldset submitButton="true">
<input type="text" token="text">
<label>Enter Value</label>
<prefix>"</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Results of $text$</title>
<search>
<query>|makeresults | eval user ="Hari" |eval report="send mail to secure" |append [|makeresults | eval user ="PEPITO" |eval report="Failure"] |fields - _time |where user=$text$ |appendpipe [|stats count as user |where user=0 |eval user="No Results"] </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
shell_pci_ent_rtr_real_monitor
<panel>
<event>
<search>
<query>sourcetype="udp:514" AND GH-SHELL-PCI
NOT (145.26.24.242 OR 145.26.24.243 OR 145.26.24.245)
NOT (02:0* AND "Green => Red" OR "Red => Green")
<earliest>rt-24h</earliest>
<latest>rt</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">50</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">none</option>
<option name="rowNumbers">1</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">raw</option>
<option name="link.visible">false</option>
</event>
</panel>
this is how my search looks like so maybe you can advise how to modify it