Dashboards & Visualizations

show no results message in the dashboard if post panel search return zero results

kranthimutyala
Explorer

Hi Guys,

I have 6 panels in a dashboard and all the panels depend on the post process search results.If a panel doesn't return any results panel gets hidden.Similarly if search results are zero in all the panels the dashboard should show/pop up a message saying no results found instead of white space.

and similarly if a panels search results are greater than zero(suppose long running searches), rather than showing blank white space panels a message should be showing like Fetching the results.

This is the sample xml which im using in all the panels to hide.

<condition match="'job.resultCount' == 0">
              <unset token="panel1"></unset>
              <unset token="count1">$job.resultCount$</unset>
            </condition>
            <condition match="'job.resultCount' > 0">
              <set token="panel1">true</set>
              <set token="count1">$job.resultCount$</set>

Regards,
Kranthi M

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@kranthimutyala,

Try this run anywhere example .
- Use Simulate "No Data" to simulate "No Data" scenario
- select time range "Last 7 days" or more to simulate "long running searches"

<form>
  <label>Show Hide Panels</label>
  <search id="base">
    <query>
      index=_*|stats count by source,index,sourcetype
    </query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time">
      <label></label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <!-- for simulating data and no data -->
    <input type="radio" token="nodata">
      <label>Simulate "No Data"</label>
      <choice value="randomstring">Yes</choice>
      <choice value="*">No</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row rejects="$panel1$,$panel2$,$panel3$">
    <panel>
      <html>
      <p align="center">No results Found!</p>
    </html>
    </panel>
  </row>
  <row>
    <panel depends="$panel1$">
      <chart>
        <search base="base">
          <query>fields index,count|search index=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel1"></set>
            </condition>
            <condition>
              <unset token="panel1"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel2$">
      <chart>
        <search base="base">
          <query>fields source,count|search source=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel2"></set>
            </condition>
            <condition>
              <unset token="panel2"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel3$">
      <chart>
        <search base="base">
          <query>fields sourcetype,count|search sourcetype=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel3"></set>
            </condition>
            <condition>
              <unset token="panel3"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

woodcock
Esteemed Legend

To ensure that there is always a result, add this to the bottom of your existing search:

| appendpipe [stats count | where count=0]
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kranthimutyala,

Try this run anywhere example .
- Use Simulate "No Data" to simulate "No Data" scenario
- select time range "Last 7 days" or more to simulate "long running searches"

<form>
  <label>Show Hide Panels</label>
  <search id="base">
    <query>
      index=_*|stats count by source,index,sourcetype
    </query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time">
      <label></label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <!-- for simulating data and no data -->
    <input type="radio" token="nodata">
      <label>Simulate "No Data"</label>
      <choice value="randomstring">Yes</choice>
      <choice value="*">No</choice>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row rejects="$panel1$,$panel2$,$panel3$">
    <panel>
      <html>
      <p align="center">No results Found!</p>
    </html>
    </panel>
  </row>
  <row>
    <panel depends="$panel1$">
      <chart>
        <search base="base">
          <query>fields index,count|search index=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel1"></set>
            </condition>
            <condition>
              <unset token="panel1"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel2$">
      <chart>
        <search base="base">
          <query>fields source,count|search source=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel2"></set>
            </condition>
            <condition>
              <unset token="panel2"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
    <panel depends="$panel3$">
      <chart>
        <search base="base">
          <query>fields sourcetype,count|search sourcetype=$nodata$</query>
          <done>
            <condition match="'job.resultCount' > 0">
              <set token="panel3"></set>
            </condition>
            <condition>
              <unset token="panel3"></unset>
            </condition>
          </done>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

kranthimutyala
Explorer

Hi renjith.nair ,

Thanks for the answer.Its working well but whenever if the results are not found we see a message No results Found! .
But when i change the input and press submit till the time i get any results its showing as No results Found!. So once the search is waiting for data i don't want to see this message. Strcitly want this message only if result count is < 0 because the user might think that no results found even if the background search is running and trying to fetch some results.

Search results < 0 -- > No results found
search waiting for data or input is changed -->? No results found message should disappear and show waiting for data

Any help is highly appreciated...

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kranthimutyala, glad it worked. It does show me the panels as "waiting". Neverthless, for the waiting, just add a progress handler to the panels

for e.g.

       <progress>
             <condition >
               <set token="panel1"></set>
             </condition>
       </progress>
0 Karma