Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Null Search Swapper
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jebabin
Engager
03-09-2017
12:35 AM
Hello,
When using the "Null Search Swapper" functionality with code like the one we can find in the "Splunk 6.x Dashboard Examples" app
( /en-US/app/simple_xml_examples/null_search_swapper?form.index_switcher=index%3D_internal&earliest=0&latest= )
So:
<progress>
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
</progress>
</search>
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
The HTML part is displayed until the search finish and return something (if it return something). Is there a way to show the html only when the search is finished and nothing has been found ?
My problem is that I've some search taking several seconds, and if user don't wait, they may think there is no result and close the page. They don't have anything to see that the query is in progress
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
niketn
Legend
03-09-2017
06:15 AM
Can you please try these couple of options?
1) Change from <progress> to <done> search event handler. All other code remains the same.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#done
2) In your existing search change condition from match="$job.resultCount$ == 0" to match="$job.resultCount$ >0"
and swap the depends and reject between chart and html panel i.e.
<chart rejects="$show_html$"> and <html depends="$show_html$">
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
niketn
Legend
03-09-2017
06:15 AM
Can you please try these couple of options?
1) Change from <progress> to <done> search event handler. All other code remains the same.
http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#done
2) In your existing search change condition from match="$job.resultCount$ == 0" to match="$job.resultCount$ >0"
and swap the depends and reject between chart and html panel i.e.
<chart rejects="$show_html$"> and <html depends="$show_html$">
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jebabin
Engager
03-09-2017
09:23 AM
Thanks, is what I was missing, thanks for the doc link that I had not found!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
niketn
Legend
03-09-2017
11:22 AM
@jababin...Glad that it worked 🙂
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!
Developer Spotlight with William Searle
The Splunk Guy: A Developer’s Path from Web to Cloud
William is a Splunk Professional Services Consultant with ...
Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!
Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...
Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!
What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...
