topic Re: How to hide dashboard panel ONLY when search results are zero? in Dashboards & Visualizations

How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 14:51:55 GMT

Currently my dashboard panel is hidden even when the search results are displayed.

I would like my dashboard panel to be hidden ONLY when the search results are zero and my panel should be displayed when the search results are displayed. How can I incorporate code for it?

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <done>
         <condition match="'job.resultCount' == 0">
           <set token="hide_panel">true</set>
         </condition>
        <condition>
     <unset token="hide_panel"></unset>
  </condition>
       </done>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 14:53:48 GMT

The below code got cut off..which is above the chart

Re: How to hide dashboard panel ONLY when search results are zero?

ehudb — Tue, 01 Nov 2016 15:01:27 GMT

Please post the entire panel code, including the start of it (depends parameter?)

Re: How to hide dashboard panel ONLY when search results are zero?

rjthibod — Tue, 01 Nov 2016 15:15:24 GMT

What version of Splunk Enterprise are you running? It must be at least 6.3 in order to use the features you are trying to use.

Re: How to hide dashboard panel ONLY when search results are zero?

rjthibod — Tue, 01 Nov 2016 15:16:34 GMT

At minimum you should have the following in the panel definition if you are running 6.3 or newer.

<panel rejects="$hide_panel$">

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 29 Sep 2020 11:38:04 GMT

**

CPU

Average % CPU Utilization

index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)\w | ^:" |stats avg(ec2cpu) as EC2_CPUUtilization
$field1.earliest$
$field1.latest$

true

ellipsisNone
0
visible
Percent
visible
visible
linear
linear
0
inherit
radialGauge
50
10
area
connect
none
0.01
default
shiny
all
0
0
ellipsisMiddle
top

**

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 15:23:10 GMT

I am using Splunk Version 6.3.2

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 15:24:35 GMT

Yes, I am using rejects in my code. But, currently my panel is hidden although search results are NOT zero. I want my panel to be hidden only when the search results are "ZERO".

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 15:50:39 GMT

I've also tried using the below code too, but doesn't work..

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
             <set token="hide_panel">true</set>
          </condition>
          <condition>
           <unset token="hide_panel"></unset>
          </condition>
        </progress>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>

Re: How to hide dashboard panel ONLY when search results are zero?

rjthibod — Tue, 01 Nov 2016 16:11:43 GMT

That will likely not work. I much rather prefer using either <done> or <finalized>, not <progress>.

I am sorry but I cannot see anything else obviously wrong. with the code.

I would be curious to see if it works if you upgrade, but that is not necessarily something you can just do.

Re: How to hide dashboard panel ONLY when search results are zero?

gcusello — Tue, 01 Nov 2016 16:39:36 GMT

Hi smuppava,
You should download the Splunk 6 Dashboard Examples (https://splunkbase.splunk.com/app/1603/) and see the "Null Search Swapper" App.
It's described how to solve your need.

Every way, in the following example there are two situation: one with results and one without results:

<dashboard>
  <label>Null Search Swapper</label>
  <row>
    <panel>
      <title>Search Logic Based on Result Count</title>
      <input type="radio" token="index_switcher">
         <label>Choose Index</label>
         <choice value="index=_internal">index=_internal</choice>
         <choice value="index=_null">index=_null</choice>
         <initialValue>index=_null</initialValue>
      </input>
        <search id="search_logic">
          <query>$index_switcher$ |  top sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>

          <!-- Progress event has access to job properties only -->
          <progress>
            <condition match="$job.resultCount$ == 0">
              <set token="show_html">foob</set>
            </condition>
            <condition>
              <unset token="show_html"/>
            </condition>
          </progress>
        </search>
      <chart rejects="$show_html$">
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
      </html>
    </panel>
  </row>
</dashboard>

Bye.
Giuseppe

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 19:06:36 GMT

Yeah..I've tried the above code. So, what happens is that my panel is hidden no matter the search results appear or not.
But, in my specific case, I would want my panel to be hidden ONLY when the search results do NOT display any results.
Any suggestions?

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Tue, 01 Nov 2016 19:07:48 GMT

Yes, I've tried done, but still doesn't work in my case. Is there a way to hide the panel when the search doesn't display any results.
Any other suggestions. This question is still NOT resolved.

Re: How to hide dashboard panel ONLY when search results are zero?

smuppava — Wed, 02 Nov 2016 14:48:10 GMT

I still have't found a solution or a way for my code to work. Can I open a case for this issue?

I need to hide the dashboard panel ONLY when search results are zero. Currently, my dashboard is been hidden although search results are displayed.

Below is my code..please do take a look..

 <title>Average % CPU Utilization</title>
 <search>
   <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
   <earliest>$field1.earliest$</earliest>
   <latest>$field1.latest$</latest>
   <done>
      <condition match="'job.resultCount' == 0">
        <set token="hide_panel">true</set>
      </condition>
     <condition>
  <unset token="hide_panel"></unset>

    </done>
 </search>
 <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
 <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
 <option name="charting.axisTitleX.visibility">visible</option>
 <option name="charting.axisTitleY.text">Percent</option>
 <option name="charting.axisTitleY.visibility">visible</option>
 <option name="charting.axisTitleY2.visibility">visible</option>
 <option name="charting.axisX.scale">linear</option>
 <option name="charting.axisY.scale">linear</option>
 <option name="charting.axisY2.enabled">0</option>
 <option name="charting.axisY2.scale">inherit</option>
 <option name="charting.chart">radialGauge</option>
 <option name="charting.chart.bubbleMaximumSize">50</option>
 <option name="charting.chart.bubbleMinimumSize">10</option>
 <option name="charting.chart.bubbleSizeBy">area</option>
 <option name="charting.chart.nullValueMode">connect</option>
 <option name="charting.chart.showDataLabels">none</option>
 <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
 <option name="charting.chart.stackMode">default</option>
 <option name="charting.chart.style">shiny</option>
 <option name="charting.drilldown">all</option>
 <option name="charting.layout.splitSeries">0</option>
 <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
 <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
 <option name="charting.legend.placement">top</option>
 </chart>
</panel>

Re: How to hide dashboard panel ONLY when search results are zero?

ID_SplunkUser — Thu, 03 Nov 2016 02:42:49 GMT

Hi,

I tried to run your code in my system, and the logic between is perfectly fine.
The only issue I can see here is in your Search Query. Try to run the query and see if it's really giving you desired Non-zero value.

Re: How to hide dashboard panel ONLY when search results are zero?

gcusello — Thu, 03 Nov 2016 13:20:09 GMT

This is an example to create both the situations (results, no results), you have to see the "progress" tag to understand hot to configure your search.
In details:
with the <condition match="$job.resultCount$ == 0"> you have the situation with no results, in this case you show an html message.
Instead of the searches of the example, you have to insert your search and manage the two situations with che $job.resultCount$ token.
Bye.
Giuseppe

Re: How to hide dashboard panel ONLY when search results are zero?

MuS — Mon, 13 Nov 2017 01:18:09 GMT

The provided dashboard example works perfectly fine. What I can see from your code is that neither your panel nor chart option have either depends or rejects set.

cheers, MuS