Hi! I was wondering if anybody knows if there's a way to hide the "populating..." text under this drillthrough on my dashboard?
That is the splunk-choice-input-message class - so you can do it like this - note that this will hide it always.
<form version="1.1" theme="light">
<label>populating</label>
<fieldset submitButton="false">
<input type="time" token="time_range" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input id="user_input" type="dropdown" token="tok_user" searchWhenChanged="true">
<label>User</label>
<search>
<query>index=_audit
| stats count by user</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>
</fieldset>
<row depends="$AlwaysHideCSS$">
<panel>
<html>
<style>
#user_input .splunk-choice-input-message{
display: none !important;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=_audit user=$tok_user$
| stats count by user</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
You can also do it more elegantly by hiding the Populating message when the search is in progress using <progress> and <done> clauses in the search, e.g.
<form version="1.1" theme="light">
<label>populating</label>
<init>
<set token="input_message_display">none</set>
</init>
<fieldset submitButton="false">
<input type="time" token="time_range" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
<change>
<set token="input_message_display">none</set>
</change>
</input>
<input id="user_input" type="dropdown" token="tok_user" searchWhenChanged="true">
<label>User</label>
<search>
<query>index=_audit
| stats count by user</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
<progress>
<set token="input_message_display">none</set>
</progress>
<done>
<set token="input_message_display"></set>
</done>
</search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>
</fieldset>
<row depends="$AlwaysHideCSS$">
<panel>
<html>
<style>
#user_input .splunk-choice-input-message{
display: $input_message_display$;
}
</style>
</html>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>index=_audit user=$tok_user$
| stats count by user</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>This will hide the populating message every time you change the time that the dropdown depends on, then when the search is finished, it will re-enable it - so that if you get no results, it will say 'Search produced no results'