Dashboards & Visualizations

Can I generate a show no panel based on a set of criteria?

Motivator

If I have a search the gives the following:

alt text

Can I get it to give a No results found. like this panel in a dashbaord, below

alt text

The idea is that I only want to show panels if they are worth looking at.
That is if they have some non-zero values worth looking at.
If No results found. is displayed I have the code to show/hide the panel here, but I cannot generate a No results found. if all the values are zero.

A sample search to play with:

| makeresults 
| eval data = "
1-Sep    0;
2-Sep    0;
" 
 | makemv delim=";" data
 | mvexpand data
 | rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)"
 | fields + Date kpi1 | fields - _time
 |search kpi1 = *
 | eval x=if(max(kpi1)=0,"dontShowPanel","showPanel")
0 Karma

Champion

Hi @HattrickNZ

If I am not wrong, as per your query you want to show "No results found" when all kpi1 is 0. You can filter the record that is greater than 0. finally you can get "No results found".

| makeresults 
| eval data = "
 1-Sep    0;
 2-Sep    0; 
 " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)" 
| fields + Date kpi1 
| fields - _time 
| where kpi1>0
0 Karma

Motivator

tks, that might look like it works, I will check and confirm.

0 Karma

Champion

Welcome. Please accept if this solution helps you.

0 Karma

SplunkTrust
SplunkTrust

@vnravikumar this would take out zero values from the chart even when values are there.

@HattrickNZ could you share your current SPL which returns above result?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Champion

Hi @niketnilay

The following logic will not exclude zero.

Hi @HattrickNZ

Pls try this

| makeresults 
| eval data = "
  1-Sep    0;
  2-Sep    0; 
   3-Sep    1; 
   4-Sep    2; 
   5-Sep    0;
  " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)" 
| fields + Date kpi1 
| fields - _time 
| eventstats sum(kpi1) as kpi1sum 
| where kpi1sum>0 
| table Date,kpi1
0 Karma