Dashboards & Visualizations
Highlighted

How to add a Custom message in Dashboard panel in replace of "No results found." message?

Path Finder

There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.

Can someone help me in how I can achieve this?

0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Path Finder

Hi somesoni2,

Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".

0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

SplunkTrust
SplunkTrust

Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.

0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Path Finder

Ok. Got it. Thanks

0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Legend

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference




| eval message="Happy Splunking!!!"


View solution in original post

0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Path Finder

@niketnilay I have below code. And it still shoes "No result found"

<panel>
  <table rejects="$show_html$">
    <title>Geographically Improbable Accesses</title>
    <searchPostProcess> `uitime(prev_time)`
                        | table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
    <drilldown>
        <link>access_search?form.user=$row.user$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"></unset>
        </condition>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="count">5</option>
  </table>
  <html depends="$show_html$">
      <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>
</panel>
0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Legend

@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Path Finder

@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.

0 Karma
Highlighted

Re: How to add a Custom message in Dashboard panel in replace of "No results found." message?

Legend

Just reverse depends and rejects between your table and panel.

Also for debugging the Set/Unset Token Value please change the table title to

<title>Geographically Improbable Accesses ($show_html$)</title>

Also, in HTML section,

 <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>

If it still does not work, please paste the final code.




| eval message="Happy Splunking!!!"


0 Karma