On occasion my panels on my dashboard studio are blank. When I hover over the bottom right the message is "Search ran successfully, but no results were returned". I understand that but to make the panels more visually appealing I want to put that message or a different message in the middle of the panel so the user better understands what is going on. Any way to edit this through the JSON source code?
Add an appendpipe command to the panel's search query.
<<your query>>
| appendpipe [ stats count | eval message="Nothing to see here" | where count=0 | fields - count ]
| <<table or stats command, etc.>>
The exact placement and content of the appendpipe depends on your query.
Most of my panels start with a tstats. Would this work with a query that starts with tstats count?
Yes, appendpipe can work with tstats. Use caution, however, with field names in appendpipe's subsearch. If the main search already has a 'count' field then use a different name in the subsearch.
| tstats count where ...
| appendpipe [ stats count as Count | eval message="Nothing to see here" | where Count=0 | fields - Count ]
| <<table or stats command, etc.>>
This does partially solve my problem, it outputs a message in the table or visual. I wanted to display an error message to be more exact and bigger with nothing else in the panel when no results are returned. Is there something in the JSON source code I can add to make this happen?