I'm developing a dashboard to display the results of several saved searches and everything's looking nice.
I just want to change the text output which is shown when a saved search returns an empty result, is it possible?
The definition of my dashboard looks as follows:
<dashboard>
<label>Dashboard Title</label>
<row>
<table>
<title>Title of report 1</title>
<searchName>name_of_saved_search_for_report_1</searchName>
</table>
</row>
<row>
<table>
<title>Title of report 2</title>
<searchName>name_of_save_search_for_report_2</searchName>
</table>
</row>
</dashboard>
Try something like this for simple xml
<dashboard>
<label>Dashboard Title</label>
<row>
<table>
<title>Title of report 1</title>
<searchString>|savedsearch name_of_saved_search_for_report_1 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
</table>
</row>
<row>
<table>
<title>Title of report 2</title>
<searchString>|savedsearch name_of_saved_search_for_report_2 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
</table>
</row>
</dashboard>
Works nicely, adding a new column with the message. Unfortunately, the other report columns are still in place and I can't seem to get rid of them. Thanks for your input!
Did you find the workaround on how to get rid of other columns ?
Here's how we did that in Advanced XML:
<module name="HTML" layoutPanel="panel_row1_col2" autoRun="True">
<param name="html"><![CDATA[
<table id="resultsTable">
<tr><td>foo</td></tr>
</table>
<script>
var rCount = "$results.resultCount$";
if (rCount == 0) {
document.getElementById("resultsTable").innerHTML="<h1>Your text here.</h1>";
}
</script>
]]></param>
</module>
Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro
Advanced XML seems to have been removed from the 6.x release, so I can't try that... but thanks 🙂