Splunk Search

How to do error handling for wrong search query in HTML view

jsharma123
Explorer

HI ,

I have a html dashboard which update a d3 graph on text input change ,
This text input is added to my search query in search manager.
But when The query is wrong or there is no data , I need to do error handling .
How can i check for this situation ?

Tags (3)
0 Karma
1 Solution

jsharma123
Explorer

I found a solution

This is what I did

search.on("search:done", function(state,job) {
           if(state.content.resultCount==0){
                d3.select("#body").select("svg").remove();

                var newSvg= d3.select("#body").append("svg")
                .attr("width", width + margin.right + margin.left)
                .attr("height", height + margin.top + margin.bottom);

                var rect = newSvg.append('rect').transition().duration(10).attr('width', 1050)
                .attr('height', 50)
                .attr('x', 40)
                .attr('y', 100)
                .style('fill', 'white')
                var text = newSvg.append('text').text('The query returned No result')
                .attr('x', 50)
                .attr('y', 150)
                .attr('fill', 'black')
                .attr("font-family", "sans-serif")
                .style("font-size", "34px");
           }
         });

var myResults =search.data('results', { // get the data from that search
                     output_mode: 'json_rows',
                     count: 0 // get all results
                 });

myResults.on("data", function() {

    console.log("Has data? ", myResults.hasData());

}

View solution in original post

jsharma123
Explorer

I found a solution

This is what I did

search.on("search:done", function(state,job) {
           if(state.content.resultCount==0){
                d3.select("#body").select("svg").remove();

                var newSvg= d3.select("#body").append("svg")
                .attr("width", width + margin.right + margin.left)
                .attr("height", height + margin.top + margin.bottom);

                var rect = newSvg.append('rect').transition().duration(10).attr('width', 1050)
                .attr('height', 50)
                .attr('x', 40)
                .attr('y', 100)
                .style('fill', 'white')
                var text = newSvg.append('text').text('The query returned No result')
                .attr('x', 50)
                .attr('y', 150)
                .attr('fill', 'black')
                .attr("font-family", "sans-serif")
                .style("font-size", "34px");
           }
         });

var myResults =search.data('results', { // get the data from that search
                     output_mode: 'json_rows',
                     count: 0 // get all results
                 });

myResults.on("data", function() {

    console.log("Has data? ", myResults.hasData());

}

niketn
Legend

@jsharma123, this is elegant. You can go ahead and accept your own answer to mark this question as answered!

In Splunk there are depends and rejects attributed which allow you to show or hide a dashboard element based on whether the token is set or not. You can refer to Null Search Swapper example in Splunk Dashboard examples app to see how that works in Simple XML and then convert the same to HTML as per your need. Since it is in similar lines with what you have already done in svg, I will let it up to you whether you want that solution 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@jsharma123, what is the error handling you need to perform?

1) Hide D3 visualization on Error or No Results.
2) Handle No Results with your Template output like "No Results Found. Please change the filter criteria."
3) Perform Text Box input Regular Expression based validation to allow only valid input
4) Invoke JavaScript based code for custom Error Handling

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jsharma123
Explorer

@niketnilay

Thanks for your reply,
I want to do "Handle No Results with your Template output like "No Results Found. Please change the filter criteria."
and as follow up action it should "Hide D3 visualization on Error or No Results."

I am using

var myResults =search.data('results', { // get the data from that search
                    output_mode: 'json_rows',
                     count: 0 // get all results
                 });

This will not even get called in case of no data.

I am looking at Search:done as well but then how to get my data when result has data?

myResults.on("search:done", function() {
   console.log("Woohoo, all done!");
 });
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...