Dashboards & Visualizations

How can I change blank dashboard studio panel message?

cybernete33
Engager

On occasion my panels on my dashboard studio are blank. When I hover over the bottom right the message is "Search ran successfully, but no results were returned". I understand that but to make the panels more visually appealing I want to put that message or a different message in the middle of the panel so the user better understands what is going on. Any way to edit this through the JSON source code?

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add an appendpipe command to the panel's search query.

<<your query>>
| appendpipe [ stats count | eval message="Nothing to see here" | where count=0 | fields - count ]
| <<table or stats command, etc.>>

The exact placement and content of the appendpipe depends on your query.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

cybernete33
Engager

Most of my panels start with a tstats. Would this work with a query that starts with tstats count?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, appendpipe can work with tstats.  Use caution, however, with field names in appendpipe's subsearch.  If the main search already has a 'count' field then use a different name in the subsearch.

| tstats count where ...
| appendpipe [ stats count as Count | eval message="Nothing to see here" | where Count=0 | fields - Count ]
| <<table or stats command, etc.>>

 

---
If this reply helps you, Karma would be appreciated.

cybernete33
Engager

This does partially solve my problem, it outputs a message in the table or visual. I wanted to display an error message to be more exact and bigger with nothing else in the panel when no results are returned. Is there something in the JSON source code I can add to make this happen?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...