Splunk Dev
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How do you hide a row depending on 3 rows?

louisawang
New Member
‎01-22-2019 12:22 AM

I have 3 rows with 3 panels in each row. If the 1st panel has no data, the row will hide itself. I have another row on top of the 3 rows displaying the title of the 3 rows. So if all the 3 rows are hidden, I would like to hide the row with the title.

In Splunk, can I use depends="$row1$,$row2$,$row3$"?

<row depends="$hide_row1$,$hide_row2$,$hide_row3$">
    <panel id="header_2">
      <html>
        <div class="container-header">
          <!--<header class="left-header">MAJORS</header>-->
            <div>2. INFRASTRUCTURE MONITORING</div>
        </div>          
      </html>
    </panel>
  </row>
  <row depends="$hide_row1$">
    <panel>
      <title>APPLICATION SERVER</title>
      <table id="appServer">
        <search>
          <query></query>
          <earliest>-180m@m</earliest>
          <latest>now</latest>
            <progress>
              <condition match="'job.resultCount' == 0">
                <unset token="hide_row1"></unset>
              </condition>
              <condition>
                <set token="hide_row1">true</set>
              </condition>
            </progress>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Server Name">
          <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Disk Space">
          <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Memory">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="CPU">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
      </table>
    </panel>

$hide_row2$ and $hide_row3$ are about the same as the panel in $hide_row1$.

Apparently, the problem is even if row 2 is not hidden, the header is hidden as well.

0 Karma
Reply

niketn
Legend
‎01-22-2019 09:03 AM

@louisawang please try out below run anywhere dashboard based on Splunk's Internal log (log_level values are INFO, ERROR and WARN. You can use any other value for testing to return 0 count for specific log_level. For example change INFO to INFO1).

It uses an independent search to get the tokens from remaining three panels and decide the tokens to hide/show each of the panel rows as well the header row depending on whether all other 3 rows are hidden or not. Please try out and confimr.
PS: Other option to do the same without independent search would be to use Simple XML JS Extension with SplunkJS stack.

<dashboard>
  <label>Hide Row Depending on Other 3 Rows</label>
  <!-- Independent search to set show/hide tokens based on Search results from three rows-->
  <search>
    <query>| makeresults
| fields - _time
| eval hidden_Row1="$hidden_Row1$", hidden_Row2="$hidden_Row2$",hidden_Row3="$hidden_Row3$" 
| eval show_row1=case(hidden_Row1=="false","true"),
       show_row2=case(hidden_Row2=="false","true"),
       show_row3=case(hidden_Row3=="false","true"),
       show_header=case(hidden_Row1=="false" OR hidden_Row2=="false" OR hidden_Row3=="false","true")
    </query>
    <done>
      <eval token="tokShowRow1">case($result.show_row1$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow2">case($result.show_row2$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow3">case($result.show_row3$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowHeader">case($result.show_header$==&quot;true&quot;,"true")</eval>
    </done>
  </search>
  <row depends="$tokShowHeader$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
  </row>
  <row depends="$tokShowRow1$">
    <panel>
      <title>Splunk Internal INFO Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=INFO
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row1">true</set>
           </condition>
           <condition>
             <set token="hidden_Row1">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow2$">
    <panel>
      <title>Splunk Internal WARN Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=WARN
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row2">true</set>
           </condition>
           <condition>
             <set token="hidden_Row2">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow3$">
    <panel>
      <title>Splunk Internal ERROR Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=ERROR
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row3">true</set>
           </condition>
           <condition>
             <set token="hidden_Row3">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply

vnravikumar
Champion
‎01-22-2019 06:45 AM

Hi @louisawang

If any of the panels contains data then heading gets displayed otherwise it won't. Please check your token whether you had unset correctly.

Working as expected

<dashboard>
  <label>hidepanel</label>
  <row depends="$hide_row1$,$hide_row2$,$hide_row3$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
   </row>
   <row depends="$hide_row1$">
     <panel>
       <title>APPLICATION SERVER1</title>
       <table id="appServer">
         <search>
           <query>index=_internal host="rk"</query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row1"></unset>
               </condition>
               <condition>
                 <set token="hide_row1">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row2$">
     <panel>
       <title>APPLICATION SERVER2</title>
       <table id="appServer2">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row2"></unset>
               </condition>
               <condition>
                 <set token="hide_row2">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row3$">
     <panel>
       <title>APPLICATION SERVER3</title>
       <table id="appServer3">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row3"></unset>
               </condition>
               <condition>
                 <set token="hide_row3">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
</dashboard>
Reply

vnravikumar
Champion
‎01-23-2019 05:24 PM

Hi @louisawang

You can use
refer my sample

0 Karma
Reply
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...
Top