Data handling guidelines
Handle search result data and errors in a custom visualization.
Check for empty data
Whenever the search results change, formatData
is called. Use this function to check for an empty results data object and throw an error.
Best practice
Show a helpful error message. For example, use the following message.
The search did not return any data.
Avoid
Do not display a blank page or dashboard panel.
Check for invalid data
Handle cases in which the visualization search does not generate data in the correct format or type for rendering. Check for the expected data format or type before rendering the visualization.
Best practice
Show a helpful error message. For example, use the following message.
This visualization requires date or time information. Try using the timechart command in your query.
Avoid
Do not display the visualization when the data type or format is incorrect for rendering.
Handle large data sets
Make sure that the custom visualization handles large result data sets correctly.
Check for results that exceed configured row limits
Check for results that exceed the configured results row limit. Compare the number of rows requested in the visualization.js
getInitialDataParams
function with the number of results that the search returns.
Check search completion status
In the case of long running searches, paging results are inaccurate before the search completes. As of the latest software version, you can use the data.meta.done
boolean flag to check on search completion.
The data.meta.done
flag is part of the data object that passes to formatData
and updateView
in visualization.js
. When the flag is true
, it indicates that the search is complete.
Example
This visualization code displays a message when the search completes.
... updateView: function(data) { if (!data) { return; } var message = 'My search job is still running'; if (data.meta.done) { message = 'My search job is done'; } this.el.innerHTML = 'Status: ' + message; } ...
Best practice
Show a helpful warning message with the visualization in case there are more results than the visualization can render. For example, use the following message.
Warning: This visualization renders up to 10,000 data points. Results might be truncated.
Formatter API reference | Design guidelines |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1, 8.1.0, 8.1.10, 8.1.11, 8.1.12
Feedback submitted, thanks!