- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- show no results message in the dashboard if post ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Guys,
I have 6 panels in a dashboard and all the panels depend on the post process search results.If a panel doesn't return any results panel gets hidden.Similarly if search results are zero in all the panels the dashboard should show/pop up a message saying no results found instead of white space.
and similarly if a panels search results are greater than zero(suppose long running searches), rather than showing blank white space panels a message should be showing like Fetching the results.
This is the sample xml which im using in all the panels to hide.
<condition match="'job.resultCount' == 0">
<unset token="panel1"></unset>
<unset token="count1">$job.resultCount$</unset>
</condition>
<condition match="'job.resultCount' > 0">
<set token="panel1">true</set>
<set token="count1">$job.resultCount$</set>
Regards,
Kranthi M
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kranthimutyala,
Try this run anywhere example .
- Use Simulate "No Data" to simulate "No Data" scenario
- select time range "Last 7 days" or more to simulate "long running searches"
<form>
<label>Show Hide Panels</label>
<search id="base">
<query>
index=_*|stats count by source,index,sourcetype
</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="time">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<!-- for simulating data and no data -->
<input type="radio" token="nodata">
<label>Simulate "No Data"</label>
<choice value="randomstring">Yes</choice>
<choice value="*">No</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row rejects="$panel1$,$panel2$,$panel3$">
<panel>
<html>
<p align="center">No results Found!</p>
</html>
</panel>
</row>
<row>
<panel depends="$panel1$">
<chart>
<search base="base">
<query>fields index,count|search index=$nodata$</query>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel1"></set>
</condition>
<condition>
<unset token="panel1"></unset>
</condition>
</done>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel depends="$panel2$">
<chart>
<search base="base">
<query>fields source,count|search source=$nodata$</query>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel2"></set>
</condition>
<condition>
<unset token="panel2"></unset>
</condition>
</done>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel depends="$panel3$">
<chart>
<search base="base">
<query>fields sourcetype,count|search sourcetype=$nodata$</query>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel3"></set>
</condition>
<condition>
<unset token="panel3"></unset>
</condition>
</done>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</form>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To ensure that there is always a result, add this to the bottom of your existing search:
| appendpipe [stats count | where count=0]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kranthimutyala,
Try this run anywhere example .
- Use Simulate "No Data" to simulate "No Data" scenario
- select time range "Last 7 days" or more to simulate "long running searches"
<form>
<label>Show Hide Panels</label>
<search id="base">
<query>
index=_*|stats count by source,index,sourcetype
</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="time">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<!-- for simulating data and no data -->
<input type="radio" token="nodata">
<label>Simulate "No Data"</label>
<choice value="randomstring">Yes</choice>
<choice value="*">No</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row rejects="$panel1$,$panel2$,$panel3$">
<panel>
<html>
<p align="center">No results Found!</p>
</html>
</panel>
</row>
<row>
<panel depends="$panel1$">
<chart>
<search base="base">
<query>fields index,count|search index=$nodata$</query>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel1"></set>
</condition>
<condition>
<unset token="panel1"></unset>
</condition>
</done>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel depends="$panel2$">
<chart>
<search base="base">
<query>fields source,count|search source=$nodata$</query>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel2"></set>
</condition>
<condition>
<unset token="panel2"></unset>
</condition>
</done>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel depends="$panel3$">
<chart>
<search base="base">
<query>fields sourcetype,count|search sourcetype=$nodata$</query>
<done>
<condition match="'job.resultCount' > 0">
<set token="panel3"></set>
</condition>
<condition>
<unset token="panel3"></unset>
</condition>
</done>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</form>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi renjith.nair ,
Thanks for the answer.Its working well but whenever if the results are not found we see a message No results Found! .
But when i change the input and press submit till the time i get any results its showing as No results Found!. So once the search is waiting for data i don't want to see this message. Strcitly want this message only if result count is < 0 because the user might think that no results found even if the background search is running and trying to fetch some results.
Search results < 0 -- > No results found
search waiting for data or input is changed -->? No results found message should disappear and show waiting for data
Any help is highly appreciated...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@kranthimutyala, glad it worked. It does show me the panels as "waiting". Neverthless, for the waiting, just add a progress handler to the panels
for e.g.
<progress>
<condition >
<set token="panel1"></set>
</condition>
</progress>
What goes around comes around. If it helps, hit it with Karma 🙂
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
