Dashboards & Visualizations

How can I change blank dashboard studio panel message?

cybernete33
Engager

On occasion my panels on my dashboard studio are blank. When I hover over the bottom right the message is "Search ran successfully, but no results were returned". I understand that but to make the panels more visually appealing I want to put that message or a different message in the middle of the panel so the user better understands what is going on. Any way to edit this through the JSON source code?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add an appendpipe command to the panel's search query.

<<your query>>
| appendpipe [ stats count | eval message="Nothing to see here" | where count=0 | fields - count ]
| <<table or stats command, etc.>>

The exact placement and content of the appendpipe depends on your query.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

cybernete33
Engager

Most of my panels start with a tstats. Would this work with a query that starts with tstats count?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, appendpipe can work with tstats.  Use caution, however, with field names in appendpipe's subsearch.  If the main search already has a 'count' field then use a different name in the subsearch.

| tstats count where ...
| appendpipe [ stats count as Count | eval message="Nothing to see here" | where Count=0 | fields - Count ]
| <<table or stats command, etc.>>

 

---
If this reply helps you, Karma would be appreciated.

cybernete33
Engager

This does partially solve my problem, it outputs a message in the table or visual. I wanted to display an error message to be more exact and bigger with nothing else in the panel when no results are returned. Is there something in the JSON source code I can add to make this happen?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...