Splunk Search

splunk dashboard

Siddharthnegi
Contributor

I want to show  a custom message when the panel shows count=0 , which means search is not giving any results but in future might give.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Siddharthnegi ,

as I said in my answers to you previous question, if you install the Splunk Dashboard Example app ( https://splunkbase.splunk.com/app/1603 ), you'll find the example "Null Search Swapper, that describes how to replace a panel with a message when no results, that's exacly the feature you need.

In the example there's the code to use in the dashboard, that you need only to customize for your searches and panels.

What's the issue?

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use this type of technique, so you set a token if there are results and the panel showing the table will display (depends=) and the panel showing the message will not display (rejects=)

<table depends="$has_results$">
  <search>
    <query>
Your search
    </query>
  </search>
  <done>
    eval token="has_results">if($job.resultCount$&gt;0, 1, null())</eval>
  </done>
</table>
<html rejects="$has_results$">
  <h1>There are no results</h1>
</html>

 

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...