Splunk Search

Timechart - Replace "No Results Found" with "No Activity for Today"

TheJagoff
Communicator

Hello (again),

To go along with my previous question regarding using span=10 minutes using the following search:
index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count |reverse

I'm using "today" in the time-picker

This works fine with searches that have data for today. However; some of my searches do not have any activity for today, so the search comes up with "No Results Found".

I would like to replace "No Results Found" with "No Activity for Today". Is this possible and how is this done?
Again, many thanks!

0 Karma
1 Solution

rjthibod
Champion

This question is a duplicate of this one: https://answers.splunk.com/answers/129774/change-no-results-found-message.html

That question hasn't been answered, but I am pretty sure the answer is no, or at least, not directly.

The HTML text is not defined in any way that is easily changed via CSS.

Instead, you can add a message block to your SimpleXML that you can control. Here is the generic pattern you can use in SimpleXML

<html depends="$search_msg$">
  <h3 style="margin: 60px 0 50px 10px;">$search_msg$</h3>
</html>
<chart rejects="$search_msg$">
  <search>
    <query>
       index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count |reverse
    </query>
    <done>
      <condition match="'job.resultCount' > 0">
        <unset token="search_msg"/>
      </condition>
      <condition>
        <set token="search_msg">No Activity Found</set>
      </condition>
    </done>          
  </search>
  ...
</chart>

View solution in original post

rjthibod
Champion

This question is a duplicate of this one: https://answers.splunk.com/answers/129774/change-no-results-found-message.html

That question hasn't been answered, but I am pretty sure the answer is no, or at least, not directly.

The HTML text is not defined in any way that is easily changed via CSS.

Instead, you can add a message block to your SimpleXML that you can control. Here is the generic pattern you can use in SimpleXML

<html depends="$search_msg$">
  <h3 style="margin: 60px 0 50px 10px;">$search_msg$</h3>
</html>
<chart rejects="$search_msg$">
  <search>
    <query>
       index=wineventlog user="*.ad" TaskCategory="Security Group Management" | timechart span=10m count |reverse
    </query>
    <done>
      <condition match="'job.resultCount' > 0">
        <unset token="search_msg"/>
      </condition>
      <condition>
        <set token="search_msg">No Activity Found</set>
      </condition>
    </done>          
  </search>
  ...
</chart>

TheJagoff
Communicator

This is exactly what I wanted. Thank you!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...