Edting dashboard

[srajanbabu]

I created a dashboard displaying certain results out of a search.i want to add show & hide options to the dashboard so that if i click show button results should get displayed and when i click hide button results should not get displayed.

[somesoni2]

One workaround to do this is to include a checkbox in the panel which says "Hide Results". When that checkbox is checked, not results are shown (query modified to return nothing). Its not same as hiding panel, but effect is same. Here is the example implementation.

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
    <label>Hide Panel Resutls</label>

    <module name="AccountBar" layoutPanel="appHeader"/>
    <module name="AppBar" layoutPanel="navigationHeader"/>
    <module name="SideviewUtils" layoutPanel="appHeader"/>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">*</param>
        <param name="clearOnJobDispatch">False</param>
        <param name="maxSize">1</param>
    </module>
    <module name="Message" layoutPanel="messaging">
        <param name="filter">splunk.search.job</param>
        <param name="clearOnJobDispatch">True</param>
        <param name="maxSize">1</param>
    </module>

    <module name="Search" layoutPanel="panel_row1_col1" >
        <param name="search">
        YOUR MAIN SEARCH QUERY
        </param>
        <module name="Checkbox" layoutPanel="panel_row1_col1" >
            <param name="name">hideResult</param>
            <param name="checked">False</param>
            <param name="float">left</param>
            <param name="label">Hide Result</param>
            <param name="labelPosition">right</param>
            <param name="offValue">
            |fields foo,bar #some random name so that no field is selected#
            </param>
            <module name="PostProcess">
                <param name="search">
                <![CDATA[
                $hideResult$
                ]]>
                </param>

                <module name="JobProgressIndicator" layoutPanel="panel_row1_col1"></module>
                <module name="Pager">
                    <param name="count">50</param>
                    <module name="SimpleResultsTable">
                    ...                 
                    </module>
                </module>       
            </module>
        </module>
    </module>       
</view>

[somesoni2]

This code (and myself) uses Sideview Util app, which provide much more simplified advanced xml for the dashboards. This app is available free in Splunk-base. The code should work after you install the same.

[srajanbabu]

when i tried this code i got something like Splunk encountered unknown module "SideViewutils" so view could not be loaded properly.

Can you please look towards it.

[somesoni2]

you might want to explore ShowHideHeader module. It provides options to show or hide the panel on click on the panel

[srajanbabu]

i need in advance XML

[Ayn]

Simple XML, advanced XML? If it's simple you'll need to convert to advanced first of all.

[srajanbabu]

i want to hide the panel showing the results

[somesoni2]

Just to be clear, you want to hide the panel you're showing results OR just want to show empty table/"No Results found" message in the dashboard panel??