Splunk Enterprise

How to display map with no results?

anissabnk
Path Finder

Hello I have a question 🙂

I am working on this map.

anissabnk_0-1677169877952.png

However, when "there are no resulst returned", I want to have the empty map and not this : 

anissabnk_2-1677170000606.png

 

What can I do this ? 

<dashboard version="1.1">
<label>HPE IMC</label>
<row>
<panel>
<title>La liste des alarmes</title>
<viz type="location_tracker_app.location_tracker">
<search>
<query>index="imcfault" sourcetype="st_imcfault" severity=3 OR severity=4
| lookup switchs.csv ip AS sourceIp
| rex field=location "^(?&lt;latitude&gt;.+?), (?&lt;longitude&gt;.+?)$" | eval latitude=if(isnull(latitude),"43.123888",latitude) | eval longitude=if(isnull(longitude),"5.953356",longitude)
| table _time latitude longitude faultDesc</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="height">800</option>
<option name="location_tracker_app.location_tracker.interval">10</option>
<option name="location_tracker_app.location_tracker.showTraces">0</option>
<option name="location_tracker_app.location_tracker.staticIcon">none</option>
<option name="location_tracker_app.location_tracker.tileSet">light_tiles</option>
<option name="refresh.display">progressbar</option>
</viz>
</panel>
</row>
</dashboard>

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Add an appendpipe command before | table.  It will create fields when no events are found.

| eval latitude=if(isnull(latitude),"43.123888",latitude) 
| eval longitude=if(isnull(longitude),"5.953356",longitude)
| appendpipe [ stats count | eval latitude="43.123888", longitude="5.953356" | where count=0 | fields - count ]
| table _time latitude longitude faultDesc

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Add an appendpipe command before | table.  It will create fields when no events are found.

| eval latitude=if(isnull(latitude),"43.123888",latitude) 
| eval longitude=if(isnull(longitude),"5.953356",longitude)
| appendpipe [ stats count | eval latitude="43.123888", longitude="5.953356" | where count=0 | fields - count ]
| table _time latitude longitude faultDesc

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

anissabnk
Path Finder

Thank youuuu for your help

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...