Custom Error View in Splunk Part 1: Listening for Search Events
If you’ve ever had a dashboard in Splunk that includes searches with errors, you’ll notice a little icon popup that alerts you of an error message. From a user standpoint, this little popup may not make it completely obvious that an error is being outputted. This can be less than ideal for the user, especially when running searches against an API, as the user should have immediate clarity as to why the search failed. A better way to handle these error alerts, to benefit the user interface perspective, would be to clearly display the error message directly within the Splunk dashboard panel.
This blog-screencast tutorial will teach you how to leverage aspects of the Splunk JavaScript Framework to display error messages directly within your dashboard panels. You can either watch the screencast below, or continue reading. The second part on adding style to our error is here.
Part 1: Listening for search events
I will be showing you an example of what the end result will be when an error message is fully displayed – allowing the user to gain immediate, fully visible feedback, not just an alert for the message. I will begin by showing you how to write a search that will generate an error – allowing us to then modify the dashboard panel to use the search’s on(“progress:done”) event to check and see if an error was returned and, if so, display it.
Building a Simple Dashboard
Let’s start by creating an invalid Splunk search that guarantees an error will be thrown:
When running the search, we will get back an error:
Now that we have an error coming back, click on ‘Save As’ < Dashboard Panel in the top right:

Name the Dashboard whatever you like. I named mine ‘Error Reporting:’

Then click on ‘View Dashboard’ and click on ‘Edit’ < Edit Source
You should see the following:
Make the following changes highlighted below: