topic Re: How do you hide a row depending on 3 rows? in Splunk Dev

How do you hide a row depending on 3 rows?

louisawang — Tue, 29 Sep 2020 22:54:07 GMT

I have 3 rows with 3 panels in each row. If the 1st panel has no data, the row will hide itself. I have another row on top of the 3 rows displaying the title of the 3 rows. So if all the 3 rows are hidden, I would like to hide the row with the title.

In Splunk, can I use depends="$row1$,$row2$,$row3$"?

<row depends="$hide_row1$,$hide_row2$,$hide_row3$">
    <panel id="header_2">
      <html>
        <div class="container-header">
          <!--<header class="left-header">MAJORS</header>-->
            <div>2. INFRASTRUCTURE MONITORING</div>
        </div>          
      </html>
    </panel>
  </row>
  <row depends="$hide_row1$">
    <panel>
      <title>APPLICATION SERVER</title>
      <table id="appServer">
        <search>
          <query></query>
          <earliest>-180m@m</earliest>
          <latest>now</latest>
            <progress>
              <condition match="'job.resultCount' == 0">
                <unset token="hide_row1"></unset>
              </condition>
              <condition>
                <set token="hide_row1">true</set>
              </condition>
            </progress>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Server Name">
          <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Disk Space">
          <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Memory">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="CPU">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
      </table>
    </panel>

$hide_row2$ and $hide_row3$ are about the same as the panel in $hide_row1$.

Apparently, the problem is even if row 2 is not hidden, the header is hidden as well.

Re: How do you hide a row depending on 3 rows?

vnravikumar — Tue, 22 Jan 2019 14:45:31 GMT

Hi @louisawang

If any of the panels contains data then heading gets displayed otherwise it won't. Please check your token whether you had unset correctly.

Working as expected

<dashboard>
  <label>hidepanel</label>
  <row depends="$hide_row1$,$hide_row2$,$hide_row3$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
   </row>
   <row depends="$hide_row1$">
     <panel>
       <title>APPLICATION SERVER1</title>
       <table id="appServer">
         <search>
           <query>index=_internal host="rk"</query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row1"></unset>
               </condition>
               <condition>
                 <set token="hide_row1">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row2$">
     <panel>
       <title>APPLICATION SERVER2</title>
       <table id="appServer2">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row2"></unset>
               </condition>
               <condition>
                 <set token="hide_row2">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row3$">
     <panel>
       <title>APPLICATION SERVER3</title>
       <table id="appServer3">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row3"></unset>
               </condition>
               <condition>
                 <set token="hide_row3">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
</dashboard>

Re: How do you hide a row depending on 3 rows?

niketn — Tue, 29 Sep 2020 22:54:20 GMT

@louisawang please try out below run anywhere dashboard based on Splunk's Internal log (log_level values are INFO, ERROR and WARN. You can use any other value for testing to return 0 count for specific log_level. For example change INFO to INFO1).

It uses an independent search to get the tokens from remaining three panels and decide the tokens to hide/show each of the panel rows as well the header row depending on whether all other 3 rows are hidden or not. Please try out and confimr.
PS: Other option to do the same without independent search would be to use Simple XML JS Extension with SplunkJS stack.

<dashboard>
  <label>Hide Row Depending on Other 3 Rows</label>
  <!-- Independent search to set show/hide tokens based on Search results from three rows-->
  <search>
    <query>| makeresults
| fields - _time
| eval hidden_Row1="$hidden_Row1$", hidden_Row2="$hidden_Row2$",hidden_Row3="$hidden_Row3$" 
| eval show_row1=case(hidden_Row1=="false","true"),
       show_row2=case(hidden_Row2=="false","true"),
       show_row3=case(hidden_Row3=="false","true"),
       show_header=case(hidden_Row1=="false" OR hidden_Row2=="false" OR hidden_Row3=="false","true")
    </query>
    <done>
      <eval token="tokShowRow1">case($result.show_row1$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow2">case($result.show_row2$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow3">case($result.show_row3$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowHeader">case($result.show_header$==&quot;true&quot;,"true")</eval>
    </done>
  </search>
  <row depends="$tokShowHeader$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
  </row>
  <row depends="$tokShowRow1$">
    <panel>
      <title>Splunk Internal INFO Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=INFO
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row1">true</set>
           </condition>
           <condition>
             <set token="hidden_Row1">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow2$">
    <panel>
      <title>Splunk Internal WARN Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=WARN
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row2">true</set>
           </condition>
           <condition>
             <set token="hidden_Row2">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow3$">
    <panel>
      <title>Splunk Internal ERROR Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=ERROR
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row3">true</set>
           </condition>
           <condition>
             <set token="hidden_Row3">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Re: How do you hide a row depending on 3 rows?

vnravikumar — Thu, 24 Jan 2019 01:24:32 GMT

Hi @louisawang

You can use
refer my sample