All Apps and Add-ons

How to customize "waiting for data" on the dashboard to some text in custom SimpleXML extensions?

balkanbgboy
New Member

Hi,
I am running real time search as dashboard and when there are no logs I got "waiting for data". Is it possible to change the source XML file and display for example "no events "?

0 Karma
1 Solution

harishalipaka
Motivator
<form>
  <label>textinput</label>
  <init>
    <set token="text">"Not in your data"</set>
  </init>
  <fieldset submitButton="true">
    <input type="text" token="text">
      <label>Enter Value</label>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Results of $text$</title>
        <search>
          <query>|makeresults | eval user ="Hari" |eval report="send mail to secure" |append [|makeresults | eval user ="PEPITO" |eval report="Failure"] |fields - _time |where user=$text$ |appendpipe [|stats count as user |where user=0 |eval user="No Results"] </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
*********All the Best***********

View solution in original post

0 Karma

harishalipaka
Motivator
<form>
  <label>textinput</label>
  <init>
    <set token="text">"Not in your data"</set>
  </init>
  <fieldset submitButton="true">
    <input type="text" token="text">
      <label>Enter Value</label>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Results of $text$</title>
        <search>
          <query>|makeresults | eval user ="Hari" |eval report="send mail to secure" |append [|makeresults | eval user ="PEPITO" |eval report="Failure"] |fields - _time |where user=$text$ |appendpipe [|stats count as user |where user=0 |eval user="No Results"] </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
*********All the Best***********
0 Karma

balkanbgboy
New Member

shell_pci_ent_rtr_real_monitor

<panel>
  <event>
    <search>
      <query>sourcetype="udp:514" AND GH-SHELL-PCI 

NOT (145.26.24.242 OR 145.26.24.243 OR 145.26.24.245)
NOT (02:0* AND "Green => Red" OR "Red => Green")

      <earliest>rt-24h</earliest>
      <latest>rt</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">50</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">none</option>
    <option name="rowNumbers">1</option>
    <option name="table.drilldown">all</option>
    <option name="table.sortDirection">asc</option>
    <option name="table.wrap">1</option>
    <option name="type">raw</option>
    <option name="link.visible">false</option> 
  </event>
</panel>
0 Karma

balkanbgboy
New Member

this is how my search looks like so maybe you can advise how to modify it

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...