How to display messages instead of "No Result Found"

[aditsss]

Hi Everyone,

I have one requirement.

I have one dashboard which consists of multiple panels.

when there is NO DATA its showing "NO RESULT FOUND" but I want to display one message "It is Error"

I am able to display it at top. But I want to display at each and every panel.

Below are my two queries for 2 panels.

I want to display in Both. 

<row>
<panel>
<chart>
<title>Overall Salesforce User Licenses</title>
<search>
<query>index="abc" sourcetype="xyz" $type$ TotalLicenses!=0 | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ |dedup OrgFolderName, LicenseName, SalesforceOrgId |chart sum(TotalLicenses) as "Total Licenses" sum(UnusedLicenses) as "Unused Licenses" sum(UsedLicenses) as "Used Licenses" by LicenseName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">-45</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Count</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.maximumNumber">999999</option>
<option name="charting.axisY.minimumNumber">0</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
<option name="height">400</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
<row>
<panel>
<table>
<title>Overall Salesforce User Licenses</title>
<search>
<query>index="abc" sourcetype="xyz" $type$ | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ |dedup OrgFolderName, LicenseName, SalesforceOrgId |stats sum(TotalLicenses) as "Total-Licenses" sum(UsedLicenses) as "Used Licenses" sum(UnusedLicenses) as "Unused Licenses" by LicenseName OrgName SalesforceOrgId | sort -Total-Licenses</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="count">30</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="rowNumbers">false</option>
<option name="wrap">false</option>
<fields>["LicenseName","OrgName","SalesforceOrgId","Total-Licenses","Used Licenses","Unused Licenses"]</fields>
</table>
</panel>
</row>

[gcusello]

Hi @aditsss,

didn't the answer to your previous question (https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Display-a-custom-Message-instead-of...) solves your need or this is different?

Ciao.

Giuseppe

[aditsss]

@gcusello 

yes my previous question is answered,

The thing that I want now is there are some panels which does not include queries .

There I am not able to display custom messages.

I want to display in each and every panel.

Is there any way to do that.

Below is my code for that panel:

<row>
<panel>
<title>Number of Licenses (Total, Used , Unused)</title>
<input type="dropdown" token="license" searchWhenChanged="true">
<label>Licenses (Total, Unused, Used)</label>
<choice value="a">Total</choice>
<choice value="b">Unused</choice>
<choice value="c">Used</choice>
<default>a</default>
<change>
<condition value="a">
<unset token="b-details"></unset>
<unset token="c-details"></unset>
<set token="a-details"></set>
</condition>
<condition value="b">
<unset token="a-details"></unset>
<unset token="c-details"></unset>
<set token="b-details"></set>
</condition>
<condition value="c">
<unset token="a-details"></unset>
<unset token="b-details"></unset>
<set token="c-details"></set>
</condition>
</change>
</input>
</panel>
</row>

[gcusello]

Hi @aditsss,

let me understand: you have panels containing only an input? Why?

Anyway, you have to define the condition for visibility (e.g. the results of another panel) and use that condition to display or not this panel ad described in my previous answer.

What's the condition to show this panel?

Ciao.

Giuseppe

[aditsss]

@gcusello 

This panel only consists of dropdown.

So I am not able to show custom message on this particular panel.

How can I achieve this.

[gcusello]

Hi @aditsss,

as I said, I don't understand a panel with only one dropdown, but surely You know why.

Anyway, what's the condition to display this panel?

is it the same of another panel? use the same condition you used in the other panel.

Is it a different one? put the new search in the head of your dashboard, as you did in the previous question,

You can also put the choose of displaying this panel or not in a Radio Input.

Ciao.

Giuseppe

[aditsss]

@gcusello 

This is the code for this complete panel.

<row>
<panel>
<title>Number of Licenses (Total, Used , Unused)</title>
<input type="dropdown" token="license" searchWhenChanged="true">
<label>Licenses (Total, Unused, Used)</label>
<choice value="a">Total</choice>
<choice value="b">Unused</choice>
<choice value="c">Used</choice>
<default>a</default>
<change>
<condition value="a">
<unset token="b-details"></unset>
<unset token="c-details"></unset>
<set token="a-details"></set>
</condition>
<condition value="b">
<unset token="a-details"></unset>
<unset token="c-details"></unset>
<set token="b-details"></set>
</condition>
<condition value="c">
<unset token="a-details"></unset>
<unset token="b-details"></unset>
<set token="c-details"></set>
</condition>
</change>
</input>
</panel>
</row>

This dropdown value consists of 3 values Total, Used , Unused so there is no search query in it.

How can I show custom message for this particular one

[gcusello]

Hi @aditsss,

I see that there isn't any search in this panel.

As I said I don't understand why create a panel with this input instead to put it in the dashboard header, but it isn't a problem because you know why.

The question is what's the condition to display this panel? maybe when you have results in another search?

if this panel must be displayed when you have results in another panel with search, you can use this other search to configure the visibility of the panel as I described in the other answer.

e.f. taking part of the previous question code:

<dashboard>
  <label>Your dashboard</label>
  <search id="your_search">
    <query>
      your_search
      | fields your_fields
    </query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <progress>
      <condition match="'job.resultCount' == 0">
        <set token="show_html">foob</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </progress>
  </search>
  <row>
    <panel>
      <table rejects="$show_html$">
        <title>Process</title>
        <search base="your_search">
          <query>
            | table your_fields
          </query>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
      <html depends="$show_html$">
        <p style="color:red;margin-left:30px;font-size:24px">No data:</p>
        <br/>
         <p style="color:blue;margin-left:30px;font-size:24px">in search results</p>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Number of Licenses (Total, Used , Unused)</title>
      <input type="dropdown" token="license" searchWhenChanged="true" rejects="$show_html$">
        <label>Licenses (Total, Unused, Used)</label>
        <choice value="a">Total</choice>
        <choice value="b">Unused</choice>
        <choice value="c">Used</choice>
        <default>a</default>
        <change>
          <condition value="a">
            <unset token="b-details"></unset>
            <unset token="c-details"></unset>
            <set token="a-details"></set>
          </condition>
          <condition value="b">
            <unset token="a-details"></unset>
            <unset token="c-details"></unset>
            <set token="b-details"></set>
          </condition>
          <condition value="c">
            <unset token="a-details"></unset>
            <unset token="b-details"></unset>
            <set token="c-details"></set>
          </condition>
        </change>
      </input>
      <html depends="$show_html$">
        <p style="color:red;margin-left:30px;font-size:24px">No data:</p>
        <br/>
         <p style="color:blue;margin-left:30px;font-size:24px">in search results</p>
      </html>
    </panel>
  </row>
</dashboard>

At least, I'd put it in the dashboard header!

Ciao.

Giuseppe

[aditsss]

@gcusello 

Is that possible that we can show Custom Message  under with "NO RESULT FOUND"  text in proper panel.

I had tried something like this:

<dashboard>
<label>No Data Found Dashboard</label>
<row>
<panel>
<html depends="$search_msg$">
<h3 style="margin: 60px 0 50px 10px;">$search_msg$</h3>
</html>
<chart rejects="$search_msg$">
<title>Overall  User Licenses</title>
<search>
<query>
index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count |reverse
</query>
<done>
<title>Overall Salesforce User Licenses</title>
<condition match="'job.resultCount' > 0">
<unset token="search_msg"/>
</condition>
<condition>
<set token="search_msg">No Activity Found</set>
</condition>
</done>
</search>
...
</chart>
</panel>
</row>

</dashboard>

But when there is  NO DATA it is coming as "NO ACTIVITY FOUND" . I want at least t it should come up with the title Overall  User Licenses in panel.

How can I achieve that.

[gcusello]

Hi @aditsss,

Sorry but I don't understand your needm let me summarize:

• you have a search,
•  when you have results, you want to display them,
• when you haven't results, you want to display a message.

At first the searhdc must be outside the panel, otherwise it isn't possible to check the panle's display.

Then, I don't undestand why you inserted a panel's title in the done section, if you want to change the panel's title you can use another token.

Could your better describe your need?

Another hint, when you want to share code, please use the "Insert/edit Code" (</>) button.

Ciao.

Giuseppe