Archive
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

How do you hide a row depending on 3 rows?

louisawang
New Member
‎01-22-2019 12:22 AM

I have 3 rows with 3 panels in each row. If the 1st panel has no data, the row will hide itself. I have another row on top of the 3 rows displaying the title of the 3 rows. So if all the 3 rows are hidden, I would like to hide the row with the title.

In Splunk, can I use depends="$row1$,$row2$,$row3$"?

<row depends="$hide_row1$,$hide_row2$,$hide_row3$">
    <panel id="header_2">
      <html>
        <div class="container-header">
          <!--<header class="left-header">MAJORS</header>-->
            <div>2. INFRASTRUCTURE MONITORING</div>
        </div>          
      </html>
    </panel>
  </row>
  <row depends="$hide_row1$">
    <panel>
      <title>APPLICATION SERVER</title>
      <table id="appServer">
        <search>
          <query></query>
          <earliest>-180m@m</earliest>
          <latest>now</latest>
            <progress>
              <condition match="'job.resultCount' == 0">
                <unset token="hide_row1"></unset>
              </condition>
              <condition>
                <set token="hide_row1">true</set>
              </condition>
            </progress>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Server Name">
          <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Disk Space">
          <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Memory">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="CPU">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
      </table>
    </panel>

$hide_row2$ and $hide_row3$ are about the same as the panel in $hide_row1$.

Apparently, the problem is even if row 2 is not hidden, the header is hidden as well.

0 Karma
Reply

niketnilay
Legend
‎01-22-2019 09:03 AM

@louisawang please try out below run anywhere dashboard based on Splunk's Internal log (log_level values are INFO, ERROR and WARN. You can use any other value for testing to return 0 count for specific log_level. For example change INFO to INFO1).

It uses an independent search to get the tokens from remaining three panels and decide the tokens to hide/show each of the panel rows as well the header row depending on whether all other 3 rows are hidden or not. Please try out and confimr.
PS: Other option to do the same without independent search would be to use Simple XML JS Extension with SplunkJS stack.

<dashboard>
  <label>Hide Row Depending on Other 3 Rows</label>
  <!-- Independent search to set show/hide tokens based on Search results from three rows-->
  <search>
    <query>| makeresults
| fields - _time
| eval hidden_Row1="$hidden_Row1$", hidden_Row2="$hidden_Row2$",hidden_Row3="$hidden_Row3$" 
| eval show_row1=case(hidden_Row1=="false","true"),
       show_row2=case(hidden_Row2=="false","true"),
       show_row3=case(hidden_Row3=="false","true"),
       show_header=case(hidden_Row1=="false" OR hidden_Row2=="false" OR hidden_Row3=="false","true")
    </query>
    <done>
      <eval token="tokShowRow1">case($result.show_row1$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow2">case($result.show_row2$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow3">case($result.show_row3$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowHeader">case($result.show_header$==&quot;true&quot;,"true")</eval>
    </done>
  </search>
  <row depends="$tokShowHeader$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
  </row>
  <row depends="$tokShowRow1$">
    <panel>
      <title>Splunk Internal INFO Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=INFO
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row1">true</set>
           </condition>
           <condition>
             <set token="hidden_Row1">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow2$">
    <panel>
      <title>Splunk Internal WARN Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=WARN
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row2">true</set>
           </condition>
           <condition>
             <set token="hidden_Row2">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow3$">
    <panel>
      <title>Splunk Internal ERROR Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=ERROR
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row3">true</set>
           </condition>
           <condition>
             <set token="hidden_Row3">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply

vnravikumar
Champion
‎01-22-2019 06:45 AM

Hi @louisawang

If any of the panels contains data then heading gets displayed otherwise it won't. Please check your token whether you had unset correctly.

Working as expected

<dashboard>
  <label>hidepanel</label>
  <row depends="$hide_row1$,$hide_row2$,$hide_row3$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
   </row>
   <row depends="$hide_row1$">
     <panel>
       <title>APPLICATION SERVER1</title>
       <table id="appServer">
         <search>
           <query>index=_internal host="rk"</query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row1"></unset>
               </condition>
               <condition>
                 <set token="hide_row1">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row2$">
     <panel>
       <title>APPLICATION SERVER2</title>
       <table id="appServer2">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row2"></unset>
               </condition>
               <condition>
                 <set token="hide_row2">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row3$">
     <panel>
       <title>APPLICATION SERVER3</title>
       <table id="appServer3">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row3"></unset>
               </condition>
               <condition>
                 <set token="hide_row3">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
</dashboard>
0 Karma
Reply

vnravikumar
Champion
‎01-23-2019 05:24 PM

Hi @louisawang

You can use
refer my sample

0 Karma
Reply
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!