Hide panel if result count is 0 not working

[vikas_sood]

Hi,

I have 3 panels which are displaying SIngle value, with a condition if result count is zero, that panel should not display on dashboard. However, it is not working properly. Stll the panels are hidden even though result count is > 0 for all. How can this be fixed?

<dashboard>
  <init>
     <set token="eduration">-24h@m</set>
     <set token="lduration">now</set>
  </init>
  
  <row>
    <panel depends="$show$">
      <single>
        <title>Panel</title>
        <search>
          <query>sarch_queryt</query>

          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>

          <progress>
             <condition match="'job.resultCount' == 0">
                 <set token="show">true</set>         
             </condition>
             
             <condition>
               <unset token="show"></unset>
             </condition>
         </progress> 
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>

    <panel depends="$show1$">
      <single>
        <title>Panel1</title>
        <search>
          <query>sarch_queryt</query>

          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>

          <progress>
             <condition match="'job.resultCount' == 0">
                 <set token="show1">true</set>         
             </condition>
             
             <condition>
               <unset token="show1"></unset>
             </condition>
         </progress> 
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>

    <panel depends="$show2$">
      <single>
        <title>Panel3</title>
        <search>
          <query>sarch_queryt</query>

          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>

          <progress>
             <condition match="'job.resultCount' == 0">
                 <set token="show2">true</set>         
             </condition>
             
             <condition>
               <unset token="show2"></unset>
             </condition>
         </progress> 
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</dashboard>

[isoutamo]

Hi

it seems that your condition has set wrongly. Not it set token value true if there is no results. You should just change those to 

<condition match="'job.resultCount' > 0">

r. Ismo

[vikas_sood]

Tried below conditions, but it's not working

          <progress>
             <condition match="$job.resultCount$ > 0">
                <set token="panel_show3">true</set>
             </condition>
             <condition>
                <unset token="panel_show3"></unset>
               
             </condition>
         </progress> 

          <progress>
             <condition match="$job.resultCount$ &gt; 0">
                <set token="panel_show3">true</set>
             </condition>
             <condition>
                <unset token="panel_show3"></unset>
               
             </condition>
         </progress> 

[ITWhisperer]

Try reversing the logic

          <progress>
             <condition match="$job.resultCount$ == 0">
                <unset token="panel_show3"></unset>
             </condition>
             <condition>
                <set token="panel_show3">true</set>
               
             </condition>
         </progress> 

[vikas_sood]

Tried that , not working.

Dashboard:

[vikas_sood]

I added an events panel and same logic is working fine with events panel.  When results are 0 , events panel is in hidden state. It does not seem to work with Single Value chart.

<row>
    <panel depends="$panel_show3$">
      <single>
        <title>Panel</title>
        <search>
          <query>search_query_count</query>
          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$ == 0">
              <unset token="panel_show3"></unset>
            </condition>
            <condition>
              <set token="panel_show3">true</set>
            </condition>
          </progress>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">block</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
        <option name="rangeValues">[0,10]</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">1</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
  <row>
    <panel depends="$events_show$">
      <event>
        <title>Events</title>
        <search>
          <query>$search_query$</query>
          <earliest>$eduration$</earliest>
          <latest>$lduration$</latest>
          <sampleRatio>1</sampleRatio>
          <progress>
            <condition match="$job.resultCount$ == 0">
              <unset token="events_show"></unset>
            </condition>
            <condition>
              <set token="events_show">true</set>
            </condition>
          </progress>
        </search>
        <option name="list.drilldown">full</option>
      </event>
    </panel>
  </row>

[isoutamo]

What is results of this query:

<query>search_query_count</query>

[vikas_sood]

Below queries are same with first one displaying count of events and second one displaying list of events.

<query>search_query_count</query>

<query>search_query</query>

When count is 0, Single value chart is displaying however, events panel is hidden:

When count is > 0, Single value chart is displaying , events panel is displaying all search results:

[ITWhisperer]

Try this: (If the minute is odd it hides, if it is even it displays)

    <panel depends="$zeroresults1$">
      <title>Zero results</title>
      <single>
        <search>
          <query>index=_internal earliest=-24h@h latest=now | bin span=1d _time | stats count by _time 
| where floor(now() / 60) % 2 == 0</query>
          <earliest>-7d@d</earliest>
          <latest>now</latest>
          <progress>
            <condition match="$job.resultCount$ == 0">
              <unset token="zeroresults1"></unset>
            </condition>
            <condition>
              <set token="zeroresults1">true</set>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>

This works on version 8.2.2.1 - which version are you using?

[vikas_sood]

I am on 7.2.5.1.

xml you provided is working, same condition I am using to show/hide panels with different token names, but that's not working.

[isoutamo · Accepted solution]

I suppose that your query has some result like one field which value is 0. Also 0 is a value, so your $job.resultCounts$ = 1 not 0.

Actually you have confirmed it already on previous post. You can fix it eg. adding 

| where <your field/count name here> > 0

to the end of your query. This should fix it. 

[vikas_sood]

That seems to be issue. Issue is resolved now.

Thanks.

[vikas_sood]

I was following section : Search tokens for dynamic display example , in 

https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/tokens

is that example wrong?

[ITWhisperer]

The example is not wrong, it is for a different usecase. It is showing a different (html) panel (not shown in the example) when the result count is zero. In your usecase, you are trying to show the same panel when the results are greater than zero and hide it otherwise. As @isoutamo suggested, you need to change the condition to reflect this.