Splunk Search

How to edit my search to display "Incomplete" on a single value dashboard if a log is not found?

jnichols914
Explorer

Hi Everyone,

I've looked over the answers for my problem, but I can't seem to get this working correctly. Here is what I want: If I do not find a log for my search, I want my single value dashboard widget to state "Incomplete" and show it in red font. I've got the the single value working if my search is found. Any help would be awesome.

Search that Picks up log correctly, but need it to say "Not Complete" if log is not found:

<query goes here> | eval status=if(like(_raw, "%gcmMtmReports%"), "EU Run Completed", "EU Run Not Complete") | eval status="EU Run Completed" | dedup status  | eval status=if(isnull(status),"Not Complete!", status) | table status | eval range=if(status="EU Run Completed","low","severe")
0 Karma
1 Solution

jnichols914
Explorer

OK, So I figured out a solution. Not exactly what I wanted, but this works with what we are trying to do. Please see my XML below. This should help people for the future.

    <panel>
          <title>Blah</title>
          <single>
            <search>
              <query><query goes here" | stats count as "Reports Generated" |untable _time count value | eval range=if(value==0,"severe","low")</query>
              <earliest>$field1.earliest$</earliest>
              <latest>$field1.latest$</latest>
            </search>
            <earliest>$field1.earliest$</earliest>
            <latest>$field1.latest$</latest>
            <option name="underLabel">Green = Completed | Red = Incomplete</option>
            <option name="showSparkline">1</option>
            <option name="showTrendIndicator">1</option>
            <option name="trendColorInterpretation">standard</option>
            <option name="trendDisplayMode">absolute</option>
            <option name="unitPosition">after</option>
            <option name="useColors">1</option>
            <option name="useThousandSeparators">1</option>
            <option name="linkView">search</option>
          </single>
        </panel>

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try. If you query has no data, it'll a row with status="Not Complete!" with range="severe"

<query goes here> | eval status=if(like(_raw, "%gcmMtmReports%"), "EU Run Completed", "EU Run Not Complete") | eval status="EU Run Completed" | dedup status  | eval status=if(isnull(status),"Not Complete!", status) | table status | eval range=if(status="EU Run Completed","low","severe") | appendpipe [| stats count| where count=0 | eval status="Not Complete!" | eval range="severe" | table status, range]
0 Karma

jnichols914
Explorer

OK, So I figured out a solution. Not exactly what I wanted, but this works with what we are trying to do. Please see my XML below. This should help people for the future.

    <panel>
          <title>Blah</title>
          <single>
            <search>
              <query><query goes here" | stats count as "Reports Generated" |untable _time count value | eval range=if(value==0,"severe","low")</query>
              <earliest>$field1.earliest$</earliest>
              <latest>$field1.latest$</latest>
            </search>
            <earliest>$field1.earliest$</earliest>
            <latest>$field1.latest$</latest>
            <option name="underLabel">Green = Completed | Red = Incomplete</option>
            <option name="showSparkline">1</option>
            <option name="showTrendIndicator">1</option>
            <option name="trendColorInterpretation">standard</option>
            <option name="trendDisplayMode">absolute</option>
            <option name="unitPosition">after</option>
            <option name="useColors">1</option>
            <option name="useThousandSeparators">1</option>
            <option name="linkView">search</option>
          </single>
        </panel>
0 Karma

sundareshr
Legend

See if this works

| eval status=if(like(_raw, "%gcmMtmReports%"), "Completed", "NotComplete") 
| stats count by status
| eval "Completed"=if(isnull(Completed) OR Completed=0, "Not Complete", "EU Run Completed")
| table "Completed" 
| eval range=if(status="EU Run Completed", "low", "severe")
0 Karma

jnichols914
Explorer

Sundareshr,

If my log exsists, your query is returning "Not Complete" and in red. So, it did not fix the issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...