Splunk Search

Dashboard: Replacing default text for empty reports

AndreasBalster
Explorer

I'm developing a dashboard to display the results of several saved searches and everything's looking nice.

I just want to change the text output which is shown when a saved search returns an empty result, is it possible?

The definition of my dashboard looks as follows:

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchName>name_of_saved_search_for_report_1</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchName>name_of_save_search_for_report_2</searchName>
    </table>
  </row>
</dashboard>
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this for simple xml

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchString>|savedsearch name_of_saved_search_for_report_1 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchString>|savedsearch name_of_saved_search_for_report_2 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
</dashboard>
0 Karma

AndreasBalster
Explorer

Works nicely, adding a new column with the message. Unfortunately, the other report columns are still in place and I can't seem to get rid of them. Thanks for your input!

snaikwade_splun
Splunk Employee
Splunk Employee

Did you find the workaround on how to get rid of other columns ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's how we did that in Advanced XML:

<module name="HTML" layoutPanel="panel_row1_col2" autoRun="True">
    <param name="html"><![CDATA[
        <table id="resultsTable">
          <tr><td>foo</td></tr>
        </table>
        <script>
          var rCount = "$results.resultCount$";
          if (rCount == 0) {
            document.getElementById("resultsTable").innerHTML="<h1>Your text here.</h1>";
          }
        </script>
    ]]></param>
</module>
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro

---
If this reply helps you, Karma would be appreciated.
0 Karma

AndreasBalster
Explorer

Advanced XML seems to have been removed from the 6.x release, so I can't try that... but thanks 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...