All Apps and Add-ons

How to change panel height from 230px to 10px if result count = 0?

subtrakt
Contributor

Hi!
Is there a way to change panel height from 230px to 10px if result count = 0? All of my searches have an appendpipe at the end so if there are no results, the chart is blank. I would like to save dashboard real-estate if possible when there is nothing to display!

... | appendpipe [stats count | eval NoResults="" | where count=0 | fields - count]

When "NoResults" occurs, I would like to change from "230px" to "10px" in the following param.

230px

Is that possible?

0 Karma

somesoni2
Revered Legend

Try something like this

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>Dynamic Height</label> 
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>   
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module> 
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>

  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="Search" layoutPanel="panel_row1_col1" >
      <param name="search">
        <![CDATA[
index=_internal earliest=-1h@h | stats count by sourcetype, source | eventstats count as total | eval height=if(total>0,"230px","10px")
            ]]>
      </param>
      <module name="ResultsValueSetter">
        <param name="fields">total,height</param>
        <module name="PostProcess">
          <param name="search">
            | fields - total,height
          </param>
          <module name="HiddenChartFormatter">
            <param name="charting.secondaryAxisTitle.text">Count</param>
            <param name="charting.chart">column</param>
            <param name="charting.chart.stackMode">stacked</param>
            <param name="charting.showMarkers">true</param>
            <param name="charting.chart.nullValueMode">zero</param>
            <param name="charting.legend.placement">bottom</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">$height$</param>
            </module>        
          </module> 
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

Does this work? It would be a nice surprise if Splunk had updated its FlashChart module to accept $foo$ tokens anywhere -- ie if it listened to your $height$ in the height param. It would surprise me though.

0 Karma

subtrakt
Contributor

When the count is 0 the NoEvents field comes in so the chart stays uniform with the rest of the charts.

Would this work and still be able to push to the dashboard ResultsValueSetter module? When append pipe kicks-in all the other fields go away and i don't think the height field will stay to push to the dashboard module.

(dddd is there so i can force NoEvents)

index=cisco dddd | eval height=if(isnotnull(NothingToReport),"25px","230px") | timechart count by index | appendpipe [stats count | eval NoEvents="" | where count=0 | fields - count ]

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...