All Apps and Add-ons

How to change panel height from 230px to 10px if result count = 0?

subtrakt
Contributor

Hi!
Is there a way to change panel height from 230px to 10px if result count = 0? All of my searches have an appendpipe at the end so if there are no results, the chart is blank. I would like to save dashboard real-estate if possible when there is nothing to display!

... | appendpipe [stats count | eval NoResults="" | where count=0 | fields - count]

When "NoResults" occurs, I would like to change from "230px" to "10px" in the following param.

230px

Is that possible?

0 Karma

somesoni2
Revered Legend

Try something like this

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>Dynamic Height</label> 
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>   
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module> 
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>

  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="Search" layoutPanel="panel_row1_col1" >
      <param name="search">
        <![CDATA[
index=_internal earliest=-1h@h | stats count by sourcetype, source | eventstats count as total | eval height=if(total>0,"230px","10px")
            ]]>
      </param>
      <module name="ResultsValueSetter">
        <param name="fields">total,height</param>
        <module name="PostProcess">
          <param name="search">
            | fields - total,height
          </param>
          <module name="HiddenChartFormatter">
            <param name="charting.secondaryAxisTitle.text">Count</param>
            <param name="charting.chart">column</param>
            <param name="charting.chart.stackMode">stacked</param>
            <param name="charting.showMarkers">true</param>
            <param name="charting.chart.nullValueMode">zero</param>
            <param name="charting.legend.placement">bottom</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">$height$</param>
            </module>        
          </module> 
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

Does this work? It would be a nice surprise if Splunk had updated its FlashChart module to accept $foo$ tokens anywhere -- ie if it listened to your $height$ in the height param. It would surprise me though.

0 Karma

subtrakt
Contributor

When the count is 0 the NoEvents field comes in so the chart stays uniform with the rest of the charts.

Would this work and still be able to push to the dashboard ResultsValueSetter module? When append pipe kicks-in all the other fields go away and i don't think the height field will stay to push to the dashboard module.

(dddd is there so i can force NoEvents)

index=cisco dddd | eval height=if(isnotnull(NothingToReport),"25px","230px") | timechart count by index | appendpipe [stats count | eval NoEvents="" | where count=0 | fields - count ]

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...