Dashboard: Replacing default text for empty reports

[AndreasBalster]

I'm developing a dashboard to display the results of several saved searches and everything's looking nice.

I just want to change the text output which is shown when a saved search returns an empty result, is it possible?

The definition of my dashboard looks as follows:

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchName>name_of_saved_search_for_report_1</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchName>name_of_save_search_for_report_2</searchName>
    </table>
  </row>
</dashboard>

[somesoni2]

Try something like this for simple xml

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchString>|savedsearch name_of_saved_search_for_report_1 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchString>|savedsearch name_of_saved_search_for_report_2 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
</dashboard>

[AndreasBalster]

Works nicely, adding a new column with the message. Unfortunately, the other report columns are still in place and I can't seem to get rid of them. Thanks for your input!

[snaikwade_splun]

Did you find the workaround on how to get rid of other columns ?

[richgalloway]

Here's how we did that in Advanced XML:

<module name="HTML" layoutPanel="panel_row1_col2" autoRun="True">
    <param name="html"><![CDATA[
        <table id="resultsTable">
          <tr><td>foo</td></tr>
        </table>
        <script>
          var rCount = "$results.resultCount$";
          if (rCount == 0) {
            document.getElementById("resultsTable").innerHTML="<h1>Your text here.</h1>";
          }
        </script>
    ]]></param>
</module>

[richgalloway]

Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro

[AndreasBalster]

Advanced XML seems to have been removed from the 6.x release, so I can't try that... but thanks 🙂