Is there a way to show a message when no search results are found?

[jamie1]

Hi There,

I have checked multiple other discussions on this forum with people after a similar solution, however, they seemed quite specific, whereas I'm looking for a general method to accomplish this.

Essentially I just want a simple way to show a message of some kind on every dashboard panel that currently doesn't have results to show, instead of the typical "No search results returned".

Any help would be appreciated,

Jamie

[ITWhisperer]

If only you hadn't mentioned Dashboard Studio - it is reasonably easy to do in SimpleXML dashboards using done handlers to set tokens and hiding/showing panels based on these tokens. The panels could be HTML panels with an appropriate message as desired.

[jamie1]

Hi @ITWhisperer 

It's a shame to hear that, as I really like the high amount of customisability that comes with using the dashboard studio.

Overall, would you suggest that the classic dashboard editor is better?

Jamie

[ITWhisperer]

Personally, I only have one Studio dashboard, and that just to test features to see if it is upto requirements yet. Everything else is with Classic dashboards and, to be fair, I do use a reasonable amount of handlers and CSS to enhance the presentation. For example, I have a panel which is displayed while a base search is running, and another while the chained search for the panel is running, and only display the final result when the chained search has completed.

[jamie1]

Thank you for your input, I do hope that they add the functionality for this as requested by @gcusello. It does seem like quite a basic implementation so I was actually surprised to find out that it isn't all that simple.

[ITWhisperer]

If your panel is a table, you could use appendpipe to add a row with a message in if there are no results

| appendpipe [| stats count as _count | where _count == 0 | eval Message="No results have been found at this time, please try again later!"]

[jamie1]

The issue with that, is that it still shows all of the other fields in the search, I'll attach an image so that you can see what I mean, but it just doesn't look very neat.

[ITWhisperer · Accepted solution]

OK a bit convoluted, but try this

| appendpipe 
    [| stats count as _count
    | where _count=0
    | fields - _count
    | eval Message="No results at this time"]
| foreach *
    [| eval 1_<<FIELD>>=if("<<FIELD>>"!="Message" AND isnotnull(<<FIELD>>),<<FIELD>>,null())]
| table *
| fields - 1_*

[jamie1]

Hey @ITWhisperer 

I've just tested your recommended search, would this work for all visualisation types? Or just statistic tables?

Thanks,

Jamie

[ITWhisperer]

Probably not - visualisations are essentially representations of table data. Referring back to my initial response, with SimpleXML/Classic dashboards, you can use tokens in these situations to display/hide panels.

[jamie1]

Hi There,

The majority of the panels on the dashboard are tables, so I'm going to accept that search as the solution. I do hope that they eventually add the option to display an image or some sort of message for all types of panel when there is no data to be displayed.

Jamie

[gcusello]

Hi @jamie1 ,

I asked this feature in Splunk Ideas and it's classified as a future feature.

If you couls share your search I could help you in the meantime.

Ciao.

Giuseppe

[jamie1]

Hi Giuseppe,

Yeah it is quite surprising that the feature doesn't already exist.

Only issue with sharing the search, is that there is 10+ searches on the current dashboard.

So I think the best course of action for me is probably to wait for the Splunk team to create the feature.

Thank you anyway though,

Jamie