Can I generate a show no panel based on a set of criteria?

[HattrickNZ]

If I have a search the gives the following:

Can I get it to give a No results found. like this panel in a dashbaord, below

The idea is that I only want to show panels if they are worth looking at.
That is if they have some non-zero values worth looking at.
If No results found. is displayed I have the code to show/hide the panel here, but I cannot generate a No results found. if all the values are zero.

A sample search to play with:

| makeresults 
| eval data = "
1-Sep    0;
2-Sep    0;
" 
 | makemv delim=";" data
 | mvexpand data
 | rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)"
 | fields + Date kpi1 | fields - _time
 |search kpi1 = *
 | eval x=if(max(kpi1)=0,"dontShowPanel","showPanel")

[vnravikumar]

Hi @HattrickNZ

If I am not wrong, as per your query you want to show "No results found" when all kpi1 is 0. You can filter the record that is greater than 0. finally you can get "No results found".

| makeresults 
| eval data = "
 1-Sep    0;
 2-Sep    0; 
 " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)" 
| fields + Date kpi1 
| fields - _time 
| where kpi1>0

[HattrickNZ]

tks, that might look like it works, I will check and confirm.

[vnravikumar]

Welcome. Please accept if this solution helps you.

[niketn]

@vnravikumar this would take out zero values from the chart even when values are there.

@HattrickNZ could you share your current SPL which returns above result?

[vnravikumar]

Hi @niketnilay

The following logic will not exclude zero.

Hi @HattrickNZ

Pls try this

| makeresults 
| eval data = "
  1-Sep    0;
  2-Sep    0; 
   3-Sep    1; 
   4-Sep    2; 
   5-Sep    0;
  " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)" 
| fields + Date kpi1 
| fields - _time 
| eventstats sum(kpi1) as kpi1sum 
| where kpi1sum>0 
| table Date,kpi1