<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Can I generate a show no panel based on a set of criteria? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422975#M27877</link>
    <description>&lt;P&gt;If I have a search the gives the following: &lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/6435iDBD6EB734ACD2E4B/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Can I get it to give a  &lt;CODE&gt;No results found.&lt;/CODE&gt; like this panel in a dashbaord, below&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/6436i802488679F74D8F6/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;The idea is that I only want to show panels if they are worth looking at. &lt;BR /&gt;
That is if they have some non-zero values worth looking at.&lt;BR /&gt;
If &lt;CODE&gt;No results found.&lt;/CODE&gt; is displayed I have the code to show/hide the panel &lt;A href="https://answers.splunk.com/answers/702108/in-a-dashboard-how-can-i-remove-the-panels-that-sa.html"&gt;here&lt;/A&gt;, but I cannot generate a &lt;CODE&gt;No results found.&lt;/CODE&gt; if all the values are zero.&lt;/P&gt;

&lt;P&gt;A sample search to play with:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval data = "
1-Sep    0;
2-Sep    0;
" 
 | makemv delim=";" data
 | mvexpand data
 | rex field=data "(?&amp;lt;Date&amp;gt;\d+-\w+)\s+(?&amp;lt;kpi1&amp;gt;\d+)"
 | fields + Date kpi1 | fields - _time
 |search kpi1 = *
 | eval x=if(max(kpi1)=0,"dontShowPanel","showPanel")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Wed, 23 Jan 2019 21:43:22 GMT</pubDate>
    <dc:creator>HattrickNZ</dc:creator>
    <dc:date>2019-01-23T21:43:22Z</dc:date>
    <item>
      <title>Can I generate a show no panel based on a set of criteria?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422975#M27877</link>
      <description>&lt;P&gt;If I have a search the gives the following: &lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/6435iDBD6EB734ACD2E4B/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;Can I get it to give a  &lt;CODE&gt;No results found.&lt;/CODE&gt; like this panel in a dashbaord, below&lt;/P&gt;

&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper" image-alt="alt text"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/6436i802488679F74D8F6/image-size/large?v=v2&amp;amp;px=999" role="button" title="alt text" alt="alt text" /&gt;&lt;/span&gt;&lt;/P&gt;

&lt;P&gt;The idea is that I only want to show panels if they are worth looking at. &lt;BR /&gt;
That is if they have some non-zero values worth looking at.&lt;BR /&gt;
If &lt;CODE&gt;No results found.&lt;/CODE&gt; is displayed I have the code to show/hide the panel &lt;A href="https://answers.splunk.com/answers/702108/in-a-dashboard-how-can-i-remove-the-panels-that-sa.html"&gt;here&lt;/A&gt;, but I cannot generate a &lt;CODE&gt;No results found.&lt;/CODE&gt; if all the values are zero.&lt;/P&gt;

&lt;P&gt;A sample search to play with:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval data = "
1-Sep    0;
2-Sep    0;
" 
 | makemv delim=";" data
 | mvexpand data
 | rex field=data "(?&amp;lt;Date&amp;gt;\d+-\w+)\s+(?&amp;lt;kpi1&amp;gt;\d+)"
 | fields + Date kpi1 | fields - _time
 |search kpi1 = *
 | eval x=if(max(kpi1)=0,"dontShowPanel","showPanel")
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 23 Jan 2019 21:43:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422975#M27877</guid>
      <dc:creator>HattrickNZ</dc:creator>
      <dc:date>2019-01-23T21:43:22Z</dc:date>
    </item>
    <item>
      <title>Re: Can I generate a show no panel based on a set of criteria?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422976#M27878</link>
      <description>&lt;P&gt;Hi @HattrickNZ&lt;/P&gt;

&lt;P&gt;If I am not wrong, as per your query you want to show "No results found" when all kpi1 is 0. You can filter the record that is greater than 0. finally you can get "No results found".&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval data = "
 1-Sep    0;
 2-Sep    0; 
 " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?&amp;lt;Date&amp;gt;\d+-\w+)\s+(?&amp;lt;kpi1&amp;gt;\d+)" 
| fields + Date kpi1 
| fields - _time 
| where kpi1&amp;gt;0
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 24 Jan 2019 03:08:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422976#M27878</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2019-01-24T03:08:20Z</dc:date>
    </item>
    <item>
      <title>Re: Can I generate a show no panel based on a set of criteria?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422977#M27879</link>
      <description>&lt;P&gt;tks, that might look like it works, I will check and confirm.&lt;/P&gt;</description>
      <pubDate>Thu, 24 Jan 2019 20:16:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422977#M27879</guid>
      <dc:creator>HattrickNZ</dc:creator>
      <dc:date>2019-01-24T20:16:32Z</dc:date>
    </item>
    <item>
      <title>Re: Can I generate a show no panel based on a set of criteria?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422978#M27880</link>
      <description>&lt;P&gt;Welcome. Please accept if this solution helps you.&lt;/P&gt;</description>
      <pubDate>Fri, 25 Jan 2019 01:33:37 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422978#M27880</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2019-01-25T01:33:37Z</dc:date>
    </item>
    <item>
      <title>Re: Can I generate a show no panel based on a set of criteria?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422979#M27881</link>
      <description>&lt;P&gt;@vnravikumar this would take out zero values from the chart even when values are there. &lt;/P&gt;

&lt;P&gt;@HattrickNZ could you share your current SPL which returns above result?&lt;/P&gt;</description>
      <pubDate>Fri, 25 Jan 2019 02:33:14 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422979#M27881</guid>
      <dc:creator>niketn</dc:creator>
      <dc:date>2019-01-25T02:33:14Z</dc:date>
    </item>
    <item>
      <title>Re: Can I generate a show no panel based on a set of criteria?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422980#M27882</link>
      <description>&lt;P&gt;Hi @niketnilay &lt;/P&gt;

&lt;P&gt;The following logic will not exclude zero.&lt;/P&gt;

&lt;P&gt;Hi @HattrickNZ &lt;/P&gt;

&lt;P&gt;Pls try this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults 
| eval data = "
  1-Sep    0;
  2-Sep    0; 
   3-Sep    1; 
   4-Sep    2; 
   5-Sep    0;
  " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?&amp;lt;Date&amp;gt;\d+-\w+)\s+(?&amp;lt;kpi1&amp;gt;\d+)" 
| fields + Date kpi1 
| fields - _time 
| eventstats sum(kpi1) as kpi1sum 
| where kpi1sum&amp;gt;0 
| table Date,kpi1
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 25 Jan 2019 10:51:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-generate-a-show-no-panel-based-on-a-set-of-criteria/m-p/422980#M27882</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2019-01-25T10:51:22Z</dc:date>
    </item>
  </channel>
</rss>

