Re: Condition match is working only for the first ...

shalomsuresh · ‎07-25-2023

I have a base search and I want to set the token based on the result count. When there is no search result I want to show the message "Search returns no data" on the dashboard.
I tried the below way,
Message doesn't show up when there is 0 search result. But if I set the token and add this message on top where its "'job.resultCount'>0, the message shows up on the dashboard.

```

<search id="baseSearch">
<done>
<condition match="'job.resultCount' > 0">
<unset token="check"></unset>
</condition>
<condition>
<set token="check">Search returns no data</set>
</condition>
</done>
<query> ... </query>
</search>

<row>
<panel depends="$check$">
<html>
<h2>$check$</h2>
</html>
</panel>
</row>

```

gcusello · ‎07-26-2023

Hi @shalomsuresh ,

if you see in the Splun kDashboard Examples app (https://splunkbase.splunk.com/app/1603) there a sample (Null Search Swapper) that solves your requirement.

Ciao.

Giuseppe

shalomsuresh · ‎07-27-2023

Sorry it didn't help. I have done a similar way as on the sample. I would like to find out what's wrong with what I have here. Appreciate your help @gcusello !

gcusello · ‎07-27-2023

Hi @shalomsuresh ,

the issue should be in the condition.

Please try this:

<search id="baseSearch">
   <query> ... </query>
   <progress>
      <condition match="$job.resultCount$ == 0">
         <set token="show_html">foob</set>
      </condition>
      <condition>
         <unset token="show_html"/>
      </condition>
   </progress>
</search>


  <chart rejects="$show_html$">
     <title>Your Panel Title</title>
        <search base="baseSearch">
             ...
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search 
            returned no results, so we've hidden the chart!</p>
      </html>
    </panel></row>

```

the options in the panel depends on the panel you're using.

Ciao.

Giuseppe

Condition match is working only for the first part, job.resultCount > 0

dashboard

token

Can’t make it to .conf25? Join us online!

Community Content Calendar, September edition

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you a member of the Splunk Community?