Dashboards & Visualizations

show no results message in the dashboard if post panel search return zero results

kranthimutyala
Path Finder

Hi Guys,

I have 6 panels in a dashboard and all the panels depend on the post process search results.If a panel doesn't return any results panel gets hidden.Similarly if search results are zero in all the panels the dashboard should show/pop up a message saying no results found instead of white space.

and similarly if a panels search results are greater than zero(suppose long running searches), rather than showing blank white space panels a message should be showing like Fetching the results.

This is the sample xml which im using in all the panels to hide.

<condition match="'job.resultCount' == 0">
              <unset token="panel1"></unset>
              <unset token="count1">$job.resultCount$</unset>
            </condition>
            <condition match="'job.resultCount' > 0">
              <set token="panel1">true</set>
              <set token="count1">$job.resultCount$</set>

Regards,
Kranthi M

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@kranthimutyala,

Try this run anywhere example .
- Use Simulate "No Data" to simulate "No Data" scenario
- select time range "Last 7 days" or more to simulate "long running searches"

<form>
  <label>Show Hide Panels</label>
  <search id="base">
    <query>
      index=_*|stats count by source,index,sourcetype
    </query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time">
      <label></label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <!-- for simulating data and no data -->
    <input type="radio" token="nodata">
      <label>Simulate "No Data"</label>
      <choice value="randomstring">Yes</choice>
      <choice value="*">No</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row rejects="$panel1$,$panel2$,$panel3$">
    <panel>
      <html>
      <p align="center">No results Found!</p>
    </html>
    </panel>
  </row>
  <row>
    <panel depends="$panel1$">
      <chart>
        <search base="base">
          <query>fields index,count|search index=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel1"></set>
            </condition>
            <condition>
              <unset token="panel1"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel2$">
      <chart>
        <search base="base">
          <query>fields source,count|search source=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel2"></set>
            </condition>
            <condition>
              <unset token="panel2"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel3$">
      <chart>
        <search base="base">
          <query>fields sourcetype,count|search sourcetype=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel3"></set>
            </condition>
            <condition>
              <unset token="panel3"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

woodcock
Esteemed Legend

To ensure that there is always a result, add this to the bottom of your existing search:

| appendpipe [stats count | where count=0]
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kranthimutyala,

Try this run anywhere example .
- Use Simulate "No Data" to simulate "No Data" scenario
- select time range "Last 7 days" or more to simulate "long running searches"

<form>
  <label>Show Hide Panels</label>
  <search id="base">
    <query>
      index=_*|stats count by source,index,sourcetype
    </query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time">
      <label></label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <!-- for simulating data and no data -->
    <input type="radio" token="nodata">
      <label>Simulate "No Data"</label>
      <choice value="randomstring">Yes</choice>
      <choice value="*">No</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row rejects="$panel1$,$panel2$,$panel3$">
    <panel>
      <html>
      <p align="center">No results Found!</p>
    </html>
    </panel>
  </row>
  <row>
    <panel depends="$panel1$">
      <chart>
        <search base="base">
          <query>fields index,count|search index=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel1"></set>
            </condition>
            <condition>
              <unset token="panel1"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel2$">
      <chart>
        <search base="base">
          <query>fields source,count|search source=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel2"></set>
            </condition>
            <condition>
              <unset token="panel2"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel3$">
      <chart>
        <search base="base">
          <query>fields sourcetype,count|search sourcetype=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel3"></set>
            </condition>
            <condition>
              <unset token="panel3"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
Happy Splunking!

kranthimutyala
Path Finder

Hi renjith.nair ,

Thanks for the answer.Its working well but whenever if the results are not found we see a message No results Found! .
But when i change the input and press submit till the time i get any results its showing as No results Found!. So once the search is waiting for data i don't want to see this message. Strcitly want this message only if result count is < 0 because the user might think that no results found even if the background search is running and trying to fetch some results.

Search results < 0 -- > No results found
search waiting for data or input is changed -->? No results found message should disappear and show waiting for data

Any help is highly appreciated...

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kranthimutyala, glad it worked. It does show me the panels as "waiting". Neverthless, for the waiting, just add a progress handler to the panels

for e.g.

       <progress>
             <condition >
               <set token="panel1"></set>
             </condition>
       </progress>
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...