How to display Custom Text instead of "No Results ...

bhavlik · ‎02-20-2020

I have created a template dashboard that I will be using to create dashboards for a many customers. This dashboard is set up to display all services we provide, regardless if that particular customer has that service installed. So if the customer doesn't have that service, the search displays a "No Results Found" message on that panel. Rather than have a customer view the report and freak out that we might not be getting data from them (some end users don't know what services their site has installed and what they don't), I want to display a custom message that tells them it could either be no data points or could be that they don't have the service.

I have tried just about every suggestion I could find on other similar posts but I am not getting the success that others did. I'm hoping someone out there has another suggestion to help me reach a solution.

Here is my search query:

index=indexname sourcetype=sourcename 
    [| inputlookup MasterList.csv 
    | search CustomerName="*CustomerName*" 
    | table propertyId 
    | format] 
| lookup MasterList.csv propertyId 
| timechart span=1mon count by CustomerName
| fields _time *customerOne
| appendpipe 
    [ stats count 
    | eval NoResults="There is no data for this time period. This could possibly be to the service not being available" 
    | where count=0 
    | table NoResults]

However, this is the what the panel looks like in the dashboard:

Some one else suggesting adding _time=now() to the append but then I get this:

| appendpipe 
    [ stats count 
    | eval NoResults="There is no data for this time period. This could possibly be to the service not being available", _time=now()
    | where count=0 
    | fields - count]

Is there anyway to have the timechart NOT displayed and just have the custom NoResult text?

bhavlik · ‎02-21-2020

Here's my work around in case others are trying to do something similar.

I added a html text panel below each of my "service" search panels and currently have them hidden. Once I clone my template to adjust information to the next customer, if they don't have a particular service, I will un-hide the html text panel and hide the corresponding search panel. Its still some manual work but having the text panel hidden in the template allows me to quickly switch which panel will be shown in the dashboard and scheduled pdf.

bhavlik · ‎02-21-2020

Here's what I use for the html text panel

</row>
   <panel>
     <title>Total Successful Meal Orders - Customer Name</title>
     <html>
       <b>Service Not Activated at Site(s)</b>&lt;br/&gt;
     </html>
   </panel>
 </row>

gcusello · ‎02-21-2020

Hi
try something like this example

your_search
| timechart count
| append [ makeresults | eval count=0 | fields count ]
| timechart sum(count) AS count
| eval count=if(count=0,"No results found",count)

Ciao.
Giuseppe

bhavlik · ‎02-21-2020

That doesn't display a custom text for me. All it does is add a 7th month onto the x-axis and rename the label on top as "count". I would add a pic but doesn't give me the option here in comments.

niketn · ‎02-20-2020

@bhavlik try the depends and rejects solution from one of my older answers which toggles the display of custom No results found message using html panel when no result is found.... https://answers.splunk.com/answers/595248/timechart-with-no-data-gives-no-results-found.html

PS: In order for above to work you would need to take out | appendpipe section from your SPL. So that search returns 0 result count for depends/rejects to work. If you read along the above answer, you will see that append/appendpipe approach is for timechart to always show up with no data to be plotted. However, seems like that is not what you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

bhavlik · ‎02-21-2020

Unfortunately I cannot use any tokens as this dashboard will be a scheduled pdf. From everything I've been able to find, tokens do not display on a scheduled pdf.

niketn · ‎02-21-2020

@bhavlik is there only one Timechart in the Scheduled Dashboard or multiple?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

bhavlik · ‎02-21-2020

@niketnilay I have several timecharts in this dashboard. Around 10 different timecharts to create 15+ panels. What I have been doing up to this point is adding a Title to the panel with "Service Not Active at Site" and leaving the No Results found. Since I will be cloning this dashboard to many, many other customers, I was looking for an automated way so I didn't have to go in an manually adjust certain panels for each customer.

How to display Custom Text instead of "No Results Found" or blank timechart?

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

Improve Data Pipelines Using Splunk Data Management

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?