Dashboards & Visualizations

"No results found" in dashboard replace with another result

user2020dy
Path Finder

I have a panel in a dashboard running correctly, but the data doesn`t appear in this dashboard every day.

user2020dy_0-1606224233101.png

 

What I want is to know, is it possible to show another panel instead of this, when I get no results in this search query? It is not comfortable to look at this empty hole.

 

I mean, if there are results - show this panel.

If there are no results - show another one instead of this.

Labels (5)
0 Karma
1 Solution

impurush
Contributor

Hi @user2020dy ,

You need to use two different tokens and two different panels to be successful in your requirement. I have faced the same problem and implemented the below code to reach the expected output.

<row>
<panel depends="$value$">
      <title>DNS</title>
      <single>
        <search>
          <progress>
            <condition match="$job.resultCount$&gt;1">
              <set token="novalue">true</set>
              <unset token="value"></unset>
            </condition>
            <condition>
              <set token="value">true</set>
              <unset token="novalue"></unset>
            </condition>
          </progress>
          <query>Your query</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </single>
    </panel>
    <panel depends="$novalue$">
      <title>DNS</title>
      <html>
        <br/>
        <br/>
        <h1 align="center">No Value</h1>
      </html>
    </panel>
</row>




View solution in original post

0 Karma

impurush
Contributor

Hi @user2020dy ,

You need to use two different tokens and two different panels to be successful in your requirement. I have faced the same problem and implemented the below code to reach the expected output.

<row>
<panel depends="$value$">
      <title>DNS</title>
      <single>
        <search>
          <progress>
            <condition match="$job.resultCount$&gt;1">
              <set token="novalue">true</set>
              <unset token="value"></unset>
            </condition>
            <condition>
              <set token="value">true</set>
              <unset token="novalue"></unset>
            </condition>
          </progress>
          <query>Your query</query>
          <earliest>-5m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </single>
    </panel>
    <panel depends="$novalue$">
      <title>DNS</title>
      <html>
        <br/>
        <br/>
        <h1 align="center">No Value</h1>
      </html>
    </panel>
</row>




0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...