Dashboards & Visualizations

How to add a Custom message in Dashboard panel in replace of "No results found." message?

SNaikwade
Path Finder

There are various reports we add in Dashboard for which we get the message "No result found" when dashboard is completely loaded. I would like to customize this message and hardcode it somewhere so that I can display the message that I want to.

Can someone help me in how I can achieve this?

0 Karma
1 Solution

niketn
Legend

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@SNaikwade... Check out Null Search Swapper example in Splunk 6.x Dashboard Examples app. You need to set a token

        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"/>
        </condition>

And then based on depends and rejects attributes you can display and/or hide any visualization including xml panel, visualizations like chart, table etc and also html panel.

  <chart rejects="$show_html$">
    <title>Top sourcetypes for index=_internal</title>
    <search base="search_logic" />
    <option name="charting.chart">bar</option>
    <option name="charting.legend.placement">none</option>
  </chart>
  <html depends="$show_html$">
     <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>

You can also refer Splunk documentation : http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SNaikwade
Path Finder

@niketnilay I have below code. And it still shoes "No result found"

<panel>
  <table rejects="$show_html$">
    <title>Geographically Improbable Accesses</title>
    <searchPostProcess> `uitime(prev_time)`
                        | table user, user_bunit, src, _time, session_city, session_country, app, prev_src, prev_time, prev_city, prev_country, prev_app, distance, speed </searchPostProcess>
    <drilldown>
        <link>access_search?form.user=$row.user$&amp;earliest=$earliest$&amp;latest=$latest$</link>
        <condition match="$job.resultCount$ == 0">
          <set token="show_html">foob</set>
        </condition>
        <condition>
          <unset token="show_html"></unset>
        </condition>
    </drilldown>
    <option name="drilldown">row</option>
    <option name="count">5</option>
  </table>
  <html depends="$show_html$">
      <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
  </html>
</panel>
0 Karma

niketn
Legend

@SNaikwade, which version of Splunk are you running? can you change from searchPostProcess to search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SNaikwade
Path Finder

@niketnilay
I am using Splunk version 6.5.2.
As you suggested I tried replacing searchPostProcess to search but still I am not getting result. I am still seeing No result found getting displayed.

0 Karma

niketn
Legend

Just reverse depends and rejects between your table and panel.

Also for debugging the Set/Unset Token Value please change the table title to

<title>Geographically Improbable Accesses ($show_html$)</title>

Also, in HTML section,

 <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart! ($show_html$)</p>

If it still does not work, please paste the final code.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SNaikwade
Path Finder

@niketnilay

reversing the depends and rejects between table and panel did the trick. Thank you So much for assistance. Now I am able to see the message displayed in

tags.

again, thank you so much.

0 Karma

niketn
Legend

@SNaikwade... Glad that it worked!!! Please accept the answers if it has helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend
0 Karma

SNaikwade
Path Finder

Hi somesoni2,

Thank you for your response. I am trying to achieve similar thing but not actually. So the post in your comment suggest how to avoid it.
I am not trying to avoid the "No result found" scenario. I would want to display some customized message instead of "No Result Found".

0 Karma

somesoni2
Revered Legend

Isn't both the same? If you implement the solution from that post, you'll get your custom message as you specify in the query, when there are no results.

0 Karma

SNaikwade
Path Finder

Ok. Got it. Thanks

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...