Dashboards & Visualizations

Hide panel if result count is 0 not working

vikas_sood
Explorer

Hi,

I have 3 panels which are displaying SIngle value, with a condition if result count is zero, that panel should not display on dashboard. However, it is not working properly. Stll the panels are hidden even though result count is > 0 for all. How can this be fixed?

<dashboard>
  <init>
     <set token="eduration">-24h@m</set>
     <set token="lduration">now</set>
  </init>
  
  <row>
    <panel depends="$show$">
      <single>
        <title>Panel</title>
        <search>
          <query>sarch_queryt</query>

          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>

          <progress>
             <condition match="'job.resultCount' == 0">
                 <set token="show">true</set>         
             </condition>
             
             <condition>
               <unset token="show"></unset>
             </condition>
         </progress> 
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>

    <panel depends="$show1$">
      <single>
        <title>Panel1</title>
        <search>
          <query>sarch_queryt</query>

          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>

          <progress>
             <condition match="'job.resultCount' == 0">
                 <set token="show1">true</set>         
             </condition>
             
             <condition>
               <unset token="show1"></unset>
             </condition>
         </progress> 
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>

    <panel depends="$show2$">
      <single>
        <title>Panel3</title>
        <search>
          <query>sarch_queryt</query>

          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>

          <progress>
             <condition match="'job.resultCount' == 0">
                 <set token="show2">true</set>         
             </condition>
             
             <condition>
               <unset token="show2"></unset>
             </condition>
         </progress> 
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

 

Labels (4)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

I suppose that your query has some result like one field which value is 0. Also 0 is a value, so your $job.resultCounts$ = 1 not 0.

Actually you have confirmed it already on previous post. You can fix it eg. adding 

 

| where <your field/count name here> > 0

 

to the end of your query. This should fix it. 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

it seems that your condition has set wrongly. Not it set token value true if there is no results. You should just change those to 

<condition match="'job.resultCount' > 0">

r. Ismo

0 Karma

vikas_sood
Explorer

Tried below conditions, but it's not working

          <progress>
             <condition match="$job.resultCount$ > 0">
                <set token="panel_show3">true</set>
             </condition>
             <condition>
                <unset token="panel_show3"></unset>
               
             </condition>
         </progress> 

 

          <progress>
             <condition match="$job.resultCount$ &gt; 0">
                <set token="panel_show3">true</set>
             </condition>
             <condition>
                <unset token="panel_show3"></unset>
               
             </condition>
         </progress> 
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try reversing the logic

          <progress>
             <condition match="$job.resultCount$ == 0">
                <unset token="panel_show3"></unset>
             </condition>
             <condition>
                <set token="panel_show3">true</set>
               
             </condition>
         </progress> 
0 Karma

vikas_sood
Explorer

Tried that , not working.

vikas_sood_1-1640942265326.png

Dashboard:

vikas_sood_2-1640942295986.png

 

0 Karma

vikas_sood
Explorer

I added an events panel and same logic is working fine with events panel.  When results are 0 , events panel is in hidden state. It does not seem to work with Single Value chart.

<row>
    <panel depends="$panel_show3$">
      <single>
        <title>Panel</title>
        <search>
          <query>search_query_count</query>
          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$ == 0">
              <unset token="panel_show3"></unset>
            </condition>
            <condition>
              <set token="panel_show3">true</set>
            </condition>
          </progress>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$events_show$">
      <event>
        <title>Events</title>
        <search>
          <query>$search_query$</query>
          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$ == 0">
              <unset token="events_show"></unset>
            </condition>
            <condition>
              <set token="events_show">true</set>
            </condition>
          </progress>
        </search>
        <option name="list.drilldown">full</option>
      </event>
    </panel>
  </row>

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

What is results of this query:

<query>search_query_count</query>
0 Karma

vikas_sood
Explorer

Below queries are same with first one displaying count of events and second one displaying list of events.

 

<query>search_query_count</query>

 

 

 

<query>search_query</query>

 

When count is 0, Single value chart is displaying however, events panel is hidden:
vikas_sood_0-1640944451196.png

 

When count is > 0, Single value chart is displaying , events panel is displaying all search results:

vikas_sood_1-1640944567925.png

 

 
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this: (If the minute is odd it hides, if it is even it displays)

 

    <panel depends="$zeroresults1$">
      <title>Zero results</title>
      <single>
        <search>
          <query>index=_internal earliest=-24h@h latest=now | bin span=1d _time | stats count by _time 
| where floor(now() / 60) % 2 == 0</query>
          <earliest>-7d@d</earliest>
          <latest>now</latest>
          <progress>
            <condition match="$job.resultCount$ == 0">
              <unset token="zeroresults1"></unset>
            </condition>
            <condition>
              <set token="zeroresults1">true</set>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>

 

This works on version 8.2.2.1 - which version are you using?

0 Karma

vikas_sood
Explorer

I am on 7.2.5.1.

xml you provided is working, same condition I am using to show/hide panels with different token names, but that's not working.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I suppose that your query has some result like one field which value is 0. Also 0 is a value, so your $job.resultCounts$ = 1 not 0.

Actually you have confirmed it already on previous post. You can fix it eg. adding 

 

| where <your field/count name here> > 0

 

to the end of your query. This should fix it. 

0 Karma

vikas_sood
Explorer

That seems to be issue. Issue is resolved now.

 

Thanks.

0 Karma

vikas_sood
Explorer

I was following section : Search tokens for dynamic display example , in 

https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/tokens

is that example wrong?

Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The example is not wrong, it is for a different usecase. It is showing a different (html) panel (not shown in the example) when the result count is zero. In your usecase, you are trying to show the same panel when the results are greater than zero and hide it otherwise. As @isoutamo suggested, you need to change the condition to reflect this.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...