Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How do I display "no data found" message when ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I display "no data found" message when there are no search results displayed for each dashboard panel?
How do I display message to the user saying "No data found" on the dashboard panel when each of the panels returns no data at all. Currently, I am hiding panels when no search results are displayed for the dashboard. So, my dashboard shows as blank when no data is been returned.
I would like to display a user friendly message to the user saying "No data found" when all the panels in my dashboard returns no results.
Thx for your help,
Sirisha
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is your dashboard in XML or HTML?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi smuppava,
You could see an example in Dashboard Examples app (you can download it from appbase https://splunkbase.splunk.com/app/1603/), showing an html message instead of "No data found".
something like this
<search id="search_logic">
<query>
mysearch
</query>
<!-- Progress event has access to job properties only -->
<progress>
<condition match="'job.resultCount' == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"></unset>
</condition>
</progress>
</search>
<row>
<panel>
<chart rejects="$show_html$">
<title>XXXXXXXXXXXXXXXXXXXXXXXXXX</title>
<search>
<query>
myquery
</query>
<earliest>0</earliest>
<latest></latest>
<progress>
<set token="count">$job.eventCount$</set>
</progress>
<cancelled>
<unset token="count"></unset>
</cancelled>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
</chart>
<html depends="$show_html$">
<p style="color:red;margin-left:30px;font-size:24px">BEWARE:</p>
<br/>
<p style="color:blue;margin-left:30px;font-size:24px">message</p>
<p style="color:blue;margin-left:30px;font-size:24px">message</p>
</html>
</panel>
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i just helped someone with this the other day
use | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I incorporated the above code into my query. But didn't work.
index=eapi_cloud_system_qa id-swiftid-green-ITE-app sourcetype=monitor OR sourcetype=monitor_log | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]|rex field=_raw "(EC2-CPUUtilization-Percent)\w | ^:" | rex field=_raw "(Host-ProcessCPUUtilization-Percent)\w | ^:" |chart values(ec2cpu) as EC2_CPUUtilization values(processcpu) AS Process_CPUUtilization by _time span=1m
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try placing the append at the very end.
index=eapi_cloud_system_qa id-swiftid-green-ITE-app sourcetype=monitor OR sourcetype=monitor_log|rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P[\w]+)" | rex field=_raw "(Host-ProcessCPUUtilization-Percent)[\w | ^:](?P[\w]+)" |chart values(ec2cpu) as EC2_CPUUtilization values(processcpu) AS Process_CPUUtilization by _time span=1m | appendpipe [ stats count | eval "NoResults"="No Data Found" | where count=0 |table "NoResults"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The above query given results in a row being displayed with 3 columns and 1 column displays no data found
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This doesn't help!
Fun with Regular Expression - multiples of nine
[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...
What’s New & Next in Splunk SOAR
