Re: Condition match is working only for the first ...

shalomsuresh · ‎07-25-2023

I have a base search and I want to set the token based on the result count. When there is no search result I want to show the message "Search returns no data" on the dashboard.
I tried the below way,
Message doesn't show up when there is 0 search result. But if I set the token and add this message on top where its "'job.resultCount'>0, the message shows up on the dashboard.

```

<search id="baseSearch">
<done>
<condition match="'job.resultCount' > 0">
<unset token="check"></unset>
</condition>
<condition>
<set token="check">Search returns no data</set>
</condition>
</done>
<query> ... </query>
</search>

<row>
<panel depends="$check$">
<html>
<h2>$check$</h2>
</html>
</panel>
</row>

```

gcusello · ‎07-26-2023

Hi @shalomsuresh ,

if you see in the Splun kDashboard Examples app (https://splunkbase.splunk.com/app/1603) there a sample (Null Search Swapper) that solves your requirement.

Ciao.

Giuseppe

shalomsuresh · ‎07-27-2023

Sorry it didn't help. I have done a similar way as on the sample. I would like to find out what's wrong with what I have here. Appreciate your help @gcusello !

gcusello · ‎07-27-2023

Hi @shalomsuresh ,

the issue should be in the condition.

Please try this:

<search id="baseSearch">
   <query> ... </query>
   <progress>
      <condition match="$job.resultCount$ == 0">
         <set token="show_html">foob</set>
      </condition>
      <condition>
         <unset token="show_html"/>
      </condition>
   </progress>
</search>


  <chart rejects="$show_html$">
     <title>Your Panel Title</title>
        <search base="baseSearch">
             ...
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search 
            returned no results, so we've hidden the chart!</p>
      </html>
    </panel></row>

```

the options in the panel depends on the panel you're using.

Ciao.

Giuseppe

Condition match is working only for the first part, job.resultCount > 0

dashboard

token

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?