Splunk Search

Dashboard: Replacing default text for empty reports

Explorer

I'm developing a dashboard to display the results of several saved searches and everything's looking nice.

I just want to change the text output which is shown when a saved search returns an empty result, is it possible?

The definition of my dashboard looks as follows:

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchName>name_of_saved_search_for_report_1</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchName>name_of_save_search_for_report_2</searchName>
    </table>
  </row>
</dashboard>
0 Karma

SplunkTrust
SplunkTrust

Try something like this for simple xml

<dashboard>
  <label>Dashboard Title</label>
  <row>
    <table>
      <title>Title of report 1</title>
      <searchString>|savedsearch name_of_saved_search_for_report_1 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
  <row>
    <table>
      <title>Title of report 2</title>
      <searchString>|savedsearch name_of_saved_search_for_report_2 | appendpipe [stats count | eval "Your custom Header"="Your Custom Message" | where count==0 | fields - count]</searchName>
    </table>
  </row>
</dashboard>
0 Karma

Explorer

Works nicely, adding a new column with the message. Unfortunately, the other report columns are still in place and I can't seem to get rid of them. Thanks for your input!

Splunk Employee
Splunk Employee

Did you find the workaround on how to get rid of other columns ?

0 Karma

SplunkTrust
SplunkTrust

Here's how we did that in Advanced XML:

<module name="HTML" layoutPanel="panel_row1_col2" autoRun="True">
    <param name="html"><![CDATA[
        <table id="resultsTable">
          <tr><td>foo</td></tr>
        </table>
        <script>
          var rCount = "$results.resultCount$";
          if (rCount == 0) {
            document.getElementById("resultsTable").innerHTML="<h1>Your text here.</h1>";
          }
        </script>
    ]]></param>
</module>
---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Advanced XML is still available. See http://docs.splunk.com/Documentation/Splunk/6.0.3/AdvancedDev/AdvancedIntro

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Advanced XML seems to have been removed from the 6.x release, so I can't try that... but thanks 🙂

0 Karma