help for displaying a text in a chart panel if no results

[jip31]

hello

`weatherevent` 
| fields host EventCode 

| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| search host=tutu
| eval EventCode=case(EventCode==41, "System reboot without cleanly shutting down first", EventCode==10111, "Device offline due to a user-mode driver crash", EventCode==10110, "Problem  with ouser-mode drivers") 
| stats count as ID by EventCode 
| eval ID=if(isnull(ID),"No critical ID for this host",ID)

I need to display a message in a chart panel if there is no results

I have done it in a eval command but it doesn't works

could you help me please?? 

[ITWhisperer]

This is a classic case of trying to display something that doesn't exist in your data. The way around this is to add to your data to give splunk something to display. In your case, you need an eventcode for every host you are interested in that doesn't already have an eventcode or another way would be to add a default event code for every host, then overwrite it with the event code for that host from the data.

[jip31]

it doesnt help me a lot...

something like this?

| stats count as ID by EventCode host
| eval ID=if(isnull(ID),"No critical ID for this host",ID)

[ITWhisperer]

Not really. You are still trying to do something for a host that splunk doesn't have any data for. Which hosts do you want these messages for?

[jip31]

I want this message for hosts that have no eventcode corresponding

it means hosts which have no ID 41, ID 10110 or 10111 events

[ITWhisperer]

Which hosts are they? If there are no events for that host in your data, how does splunk know which hosts you are interested in?

[jip31]

But I dont need to identify the hostname concerned...

I just need to display a message is there is no event with the related ID......

[ITWhisperer]

You said earlier

| stats count as ID by EventCode host
| eval ID=if(isnull(ID),"No critical ID for this host",ID)

This mentions host. Are you now saying you aren't interested in the host?

[jip31]

I use a input token in my dashboard

This input coorespond to the hostname I need to check

    <input type="text" token="tok_filterhost" searchWhenChanged="true">
      <label>Hostname</label>
      <default>*</default>
    </input>

 If there is not event ID for this host I need to display a message

`weatherevent` 
| fields host EventCode 
| search host=$tok_filterhost$
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval EventCode=case(EventCode==41, "System reboot without cleanly shutting down first", EventCode==10111, "Device offline due to a user-mode driver crash", EventCode==10110, "Problem  with ouser-mode drivers") 
| stats count as ID by EventCode 
| eval ID=if(isnull(ID),"No critical ID for this host",ID)