Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How to add a Custom message in Dashboard panel...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.
Can someone help me in how I can achieve this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay I have below code. And it still shoes "No result found"
<panel>
<table rejects="$show_html$">
<title>Geographically Improbable Accesses</title>
<searchPostProcess> `uitime(prev_time)`
| table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
<drilldown>
<link>access_search?form.user=$row.user$&earliest=$earliest$&latest=$latest$</link>
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"></unset>
</condition>
</drilldown>
<option name="drilldown">row</option>
<option name="count">5</option>
</table>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just reverse depends and rejects between your table and panel.
Also for debugging the Set/Unset Token Value please change the table title to
<title>Geographically Improbable Accesses ($show_html$)</title>
Also, in HTML section,
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>
If it still does not work, please paste the final code.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay
reversing the depends and rejects between table and panel did the trick. Thank you So much for assistance. Now I am able to see the message displayed in
tags.
again, thank you so much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you looking to do something like this?
https://answers.splunk.com/answers/124157/timecharts-and-how-to-avoid-no-results-found-inspect.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi somesoni2,
Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok. Got it. Thanks
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
