report/table/pannel to not show if there is no data

[robertlynch2020]

Hi

Is is possible to get the report to not show if there is no data. Sometime i get data for 5 out of 10 reports. So there is a lot of white space on the dashboard.

Ideally i don't want to show the report if no data is in it.

any ideas 🙂

[MuS]

Hi robertlynch2020,

This can be done in simple XML using a combination of depends and condition match="'job.resultCount' > 0". Take a look at this run everywhere example, which searches the index=_internal sourcetype=splunkd over the last 5 seconds and only shows the result if 'job.resultCount' is greater than 0

<dashboard>
   <row>
     <panel depends="$panel_show$">
       <chart>
         <title>index=_internal search over the last 5 seconds</title>
         <search id="mySearch">
           <query>index=_internal  sourcetype=splunkd | timechart span=1sec count by sourcetype</query>
           <earliest>-5s@s</earliest>
           <latest>now</latest>   
       <progress>
            <condition match="'job.resultCount' > 0">
                <set token="panel_show">true</set>
            </condition>
            <condition>
                <unset token="panel_show"/>
            </condition>
        </progress> 
         </search>
         <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
         <option name="charting.axisTitleX.visibility">visible</option>
         <option name="charting.axisTitleY.visibility">visible</option>
         <option name="charting.axisTitleY2.visibility">visible</option>
         <option name="charting.axisX.scale">linear</option>
         <option name="charting.axisY.scale">linear</option>
         <option name="charting.axisY2.enabled">0</option>
         <option name="charting.axisY2.scale">inherit</option>
         <option name="charting.chart">column</option>
         <option name="charting.chart.bubbleMaximumSize">50</option>
         <option name="charting.chart.bubbleMinimumSize">10</option>
         <option name="charting.chart.bubbleSizeBy">area</option>
         <option name="charting.chart.nullValueMode">gaps</option>
         <option name="charting.chart.showDataLabels">none</option>
         <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
         <option name="charting.chart.stackMode">stacked</option>
         <option name="charting.chart.style">shiny</option>
         <option name="charting.drilldown">all</option>
         <option name="charting.layout.splitSeries">0</option>
         <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
         <option name="charting.legend.placement">right</option>
         <option name="refresh.auto.interval">5</option>           
       </chart>
     </panel>
   </row>
 </dashboard>

You can read more about event handling in simple XML in the docs http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/EventHandlerReference

Hope this helps to get you started ...

cheers, MuS

[woodcock]

What do you mean by "report"?