Dashboards & Visualizations

How to display Custom Text instead of "No Results Found" or blank timechart?

bhavlik
Path Finder

I have created a template dashboard that I will be using to create dashboards for a many customers. This dashboard is set up to display all services we provide, regardless if that particular customer has that service installed. So if the customer doesn't have that service, the search displays a "No Results Found" message on that panel. Rather than have a customer view the report and freak out that we might not be getting data from them (some end users don't know what services their site has installed and what they don't), I want to display a custom message that tells them it could either be no data points or could be that they don't have the service.

I have tried just about every suggestion I could find on other similar posts but I am not getting the success that others did. I'm hoping someone out there has another suggestion to help me reach a solution.

Here is my search query:

index=indexname sourcetype=sourcename 
    [| inputlookup MasterList.csv 
    | search CustomerName="*CustomerName*" 
    | table propertyId 
    | format] 
| lookup MasterList.csv propertyId 
| timechart span=1mon count by CustomerName
| fields _time *customerOne
| appendpipe 
    [ stats count 
    | eval NoResults="There is no data for this time period. This could possibly be to the service not being available" 
    | where count=0 
    | table NoResults]

However, this is the what the panel looks like in the dashboard:
alt text

Some one else suggesting adding _time=now() to the append but then I get this:

| appendpipe 
    [ stats count 
    | eval NoResults="There is no data for this time period. This could possibly be to the service not being available", _time=now()
    | where count=0 
    | fields - count]

alt text

Is there anyway to have the timechart NOT displayed and just have the custom NoResult text?

0 Karma

bhavlik
Path Finder

Here's my work around in case others are trying to do something similar.

I added a html text panel below each of my "service" search panels and currently have them hidden. Once I clone my template to adjust information to the next customer, if they don't have a particular service, I will un-hide the html text panel and hide the corresponding search panel. Its still some manual work but having the text panel hidden in the template allows me to quickly switch which panel will be shown in the dashboard and scheduled pdf.

0 Karma

bhavlik
Path Finder

Here's what I use for the html text panel

</row>
   <panel>
     <title>Total Successful Meal Orders - Customer Name</title>
     <html>
       <b>Service Not Activated at Site(s)</b>&lt;br/&gt;
     </html>
   </panel>
 </row>
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
try something like this example

your_search
| timechart count
| append [ makeresults | eval count=0 | fields count ]
| timechart sum(count) AS count
| eval count=if(count=0,"No results found",count)

Ciao.
Giuseppe

0 Karma

bhavlik
Path Finder

That doesn't display a custom text for me. All it does is add a 7th month onto the x-axis and rename the label on top as "count". I would add a pic but doesn't give me the option here in comments.

0 Karma

niketn
Legend

@bhavlik try the depends and rejects solution from one of my older answers which toggles the display of custom No results found message using html panel when no result is found.... https://answers.splunk.com/answers/595248/timechart-with-no-data-gives-no-results-found.html

PS: In order for above to work you would need to take out | appendpipe section from your SPL. So that search returns 0 result count for depends/rejects to work. If you read along the above answer, you will see that append/appendpipe approach is for timechart to always show up with no data to be plotted. However, seems like that is not what you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bhavlik
Path Finder

Unfortunately I cannot use any tokens as this dashboard will be a scheduled pdf. From everything I've been able to find, tokens do not display on a scheduled pdf.

0 Karma

niketn
Legend

@bhavlik is there only one Timechart in the Scheduled Dashboard or multiple?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

bhavlik
Path Finder

@niketnilay I have several timecharts in this dashboard. Around 10 different timecharts to create 15+ panels. What I have been doing up to this point is adding a Title to the panel with "Service Not Active at Site" and leaving the No Results found. Since I will be cloning this dashboard to many, many other customers, I was looking for an automated way so I didn't have to go in an manually adjust certain panels for each customer.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...