Re: splunk dashboard

Siddharthnegi · ‎05-08-2024

I want to show a custom message when the panel shows count=0 , which means search is not giving any results but in future might give.

gcusello · ‎05-08-2024

Hi @Siddharthnegi ,

as I said in my answers to you previous question, if you install the Splunk Dashboard Example app ( https://splunkbase.splunk.com/app/1603 ), you'll find the example "Null Search Swapper, that describes how to replace a panel with a message when no results, that's exacly the feature you need.

In the example there's the code to use in the dashboard, that you need only to customize for your searches and panels.

What's the issue?

Ciao.

Giuseppe

bowesmana · ‎05-08-2024

Use this type of technique, so you set a token if there are results and the panel showing the table will display (depends=) and the panel showing the message will not display (rejects=)

<table depends="$has_results$">
  <search>
    <query>
Your search
    </query>
  </search>
  <done>
    eval token="has_results">if($job.resultCount$&gt;0, 1, null())</eval>
  </done>
</table>
<html rejects="$has_results$">
  <h1>There are no results</h1>
</html>

splunk dashboard

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation