Dashboards & Visualizations

Dashboard panels becoming unhidden on page refresh

thisissplunk
Builder

I hide certain panels if their results are 0 in my dashboard. This works great when I load up my dashboard page initially. However, if I manually refresh the browser page, these panels seems to re-search but continue to show themselves even when they have 0 results. The only way I can get them to hide again is to go to the main dashboard link without the trailing field/values for time etc in the URL.

This is one of the panels code and the hide logic is the same throughout (within "progress" block):

  <row>
    <panel depends="$exec_show$">
      <title>Pending Executive Summaries</title>
      <table>
        <search>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="exec_show">true</set>
            </condition>
            <condition>
              <unset token="exec_show"></unset>
            </condition>
          </progress>
          <query>
MY QUERY
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>

Of note is that the data is from an | inputlookup search command and uses global time because it's more of a DB dump than events over time.

Anyone know how to keep the panels hidden on browser refresh?

0 Karma

thisissplunk
Builder

Please ignore...

I was setting the token unintentionally in another search in the dashboard due to a poor copy/paste.

0 Karma

niketn
Legend

@thisissplunk if you have time input with token name as time_tok then corresponding earliest and latest tokens will be $time_tok.earliest$ and $time_tok.latest$ respectively, not $earliest$ or $latest$. Please verify and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

thisissplunk
Builder

I have the time picker set to Global as the time is irrelevant. The data is essentially a csv dump of rows without _time being used.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...