Splunk Search

Dashboard: Replacing default text for empty reports

AndreasBalster
Explorer

I'm developing a dashboard to display the results of several saved searches and everything's looking nice.

I just want to change the text output which is shown when a saved search returns an empty result, is it possible?

The definition of my dashboard looks as follows:

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchName>name_of_saved_search_for_report_1</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchName>name_of_save_search_for_report_2</searchName>
    </table>
  </row>
</dashboard>
0 Karma

somesoni2
Revered Legend

Try something like this for simple xml

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchString>|savedsearch name_of_saved_search_for_report_1 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchString>|savedsearch name_of_saved_search_for_report_2 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
</dashboard>
0 Karma

AndreasBalster
Explorer

Works nicely, adding a new column with the message. Unfortunately, the other report columns are still in place and I can't seem to get rid of them. Thanks for your input!

snaikwade_splun
Splunk Employee
Splunk Employee

Did you find the workaround on how to get rid of other columns ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's how we did that in Advanced XML:

<module name="HTML" layoutPanel="panel_row1_col2" autoRun="True">
    <param name="html"><![CDATA[
        <table id="resultsTable">
          <tr><td>foo</td></tr>
        </table>
        <script>
          var rCount = "$results.resultCount$";
          if (rCount == 0) {
            document.getElementById("resultsTable").innerHTML="<h1>Your text here.</h1>";
          }
        </script>
    ]]></param>
</module>
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro

---
If this reply helps you, Karma would be appreciated.
0 Karma

AndreasBalster
Explorer

Advanced XML seems to have been removed from the 6.x release, so I can't try that... but thanks 🙂

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...