Dashboards & Visualizations

Custom Message for "search is waiting for input" Splunk 7.3.2

gorosco
Engager

I want to replace the message for a custom message in HTML so I can let my users know what they need to do (many of them has problems with english so I want to replace the message for it in their language)

So far I've made a workaround with this:


<panel>
<input type="dropdown" token="run" searchWhenChanged="true">
<label>Run ?</label>
<choice value="null">No</choice>
<choice value="index=myindex">Yes</choice>
<default>null</default>
</input>
<chart depends="$InvResults$">
<search>
<done>
<condition match="$job.resultCount$==0">
<unset token="InvResults"></unset>
</condition>
<condition>
<set token="InvResults">true</set>
</condition>
</done>
<query>$run$ -- searchstring--</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.chart">line</option>
<option name="refresh.display">progressbar</option>
</chart>
<html rejects="$InvResults$">
<div style="font-weight:bold;text-align:center;font-size:200%;color:#FF3636">Favor selecionar pelo menos 1 dos valores dos tokens acima"</div>
</html>

So as you can see I can manage the "No results found" but while it is "wating for input" I still couldn't find a way around it.

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...