Dashboards & Visualizations

How do I hide panel when "no results found" text is displayed on dashboard

smuppava
Explorer

How do I hide my dashboard when I see "no results found" text displayed on my dashboard? I tried the code given by Splunk team on this website, but still didn't work.

Below is my code and doesn't hide the dashboard. I do see "no results found" text on my dashboard instead. Please do provide your inputs.

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
        </progress>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>

Thx for your help

dbcase
Motivator

Try this

<search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>
0 Karma

sundareshr
Legend

Try setting the tokens when <done> OR <finalized>, not <progress>

<done>
    <condition match="match('job.resultCount' == 0)">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </done
0 Karma

smuppava
Explorer

My dashboard panel is hidden right now although I do have search results.

I want my panel to be hidden ONLY when the search results are zero..can you please help?

Below is the code I am using

< panel rejects ="$hide_panel$">

Average % CPU Utilization

index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)\w | ^:" |stats avg(ec2cpu) as EC2_CPUUtilization
$field1.earliest$
$field1.latest$


true





0 Karma

gokadroid
Motivator

your Panel start tag is missing in the sample code. Can you check If you have this there when Panel tag begins:

  <panel depends="$hide_panel$">
0 Karma

cmerriman
Super Champion

do you have a depends statement? It may have been cut off? Also, set the token when job.resultCount=0, try that.

 <panel rejects="$hide_panel$">
  <chart>
     <title>Average % CPU Utilization</title>
     <search>
       <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
       <earliest>$field1.earliest$</earliest>
       <latest>$field1.latest$</latest>
       <done>
           <condition match="'job.resultCount' == 0">
             <set token="hide_panel">true</set>
           </condition>
         </done>
     </search>
     <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
     <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
     <option name="charting.axisTitleX.visibility">visible</option>
     <option name="charting.axisTitleY.text">Percent</option>
     <option name="charting.axisTitleY.visibility">visible</option>
     <option name="charting.axisTitleY2.visibility">visible</option>
     <option name="charting.axisX.scale">linear</option>
     <option name="charting.axisY.scale">linear</option>
     <option name="charting.axisY2.enabled">0</option>
     <option name="charting.axisY2.scale">inherit</option>
     <option name="charting.chart">radialGauge</option>
     <option name="charting.chart.bubbleMaximumSize">50</option>
     <option name="charting.chart.bubbleMinimumSize">10</option>
     <option name="charting.chart.bubbleSizeBy">area</option>
     <option name="charting.chart.nullValueMode">connect</option>
     <option name="charting.chart.showDataLabels">none</option>
     <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
     <option name="charting.chart.stackMode">default</option>
     <option name="charting.chart.style">shiny</option>
     <option name="charting.drilldown">all</option>
     <option name="charting.layout.splitSeries">0</option>
     <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
     <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
     <option name="charting.legend.placement">top</option>
   </chart>
 </panel>
0 Karma

smuppava
Explorer

Yes, I do have a depends statement in my code, got cut off during my cut paste.

This is my code..

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
        </progress>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>
0 Karma

smuppava
Explorer

Tried the below suggestion and still doesn't hide my panel..

you should set the code when the resultcount is 0

<progress>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

below is my updated code:

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
    <condition match="'job.resultCount'== 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>
0 Karma

cmerriman
Super Champion

see my updated syntax at the top.

0 Karma

smuppava
Explorer

depends was used above chart..

Still doesn't work..can you tell me if I could use reject instead of depend? can you please help me with how reject could be used within my code?

0 Karma

smuppava
Explorer

Follow your comments and the panel is still not hidden, below is my code: Based on your code, you need to switch the set and unset lines. You should be setting the token when job.resultCount is not 0. Unless you are using rejects instead of depends, but you said you are using depends

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' != 0">
            <unset token="hide_panel"></unset>
            </condition>
          <condition>
             <set token="hide_panel">true</set>
          </condition>
        </progress>
0 Karma

cmerriman
Super Champion

you should set the token when the resultcount is 0

   <progress>
       <condition match="'job.resultCount' == 0">
         <set token="hide_panel">true</set>
         </condition>
       <condition>
          <unset token="hide_panel"></unset>
       </condition>
     </progress>
0 Karma

smuppava
Explorer

Tried your updated syntax, but my panel is still NOT hidden and I still do see the same result "no result found" on my panel...


  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
       <progress>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

0 Karma

cmerriman
Super Champion

I changed depends to reject and also changed <progress> to <done> while also removing the <condition> <unset token="hide_panel"></unset> </condition>

I tried it on a test dashboard and got it to hide the panel when empty and show the panel when there were results.

0 Karma

smuppava
Explorer

Add the below reject for the above code before chart as well..

0 Karma

smuppava
Explorer

I tried the above as you've suggested and still didn't work. Am I doing anything wrong here?


  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
       <done>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
          </done>
    </search>
0 Karma

cmerriman
Super Champion

You have <panel rejects="$hide_panel$"> ?

0 Karma

smuppava
Explorer

Didn't you want me to use reject instead of depends? Can you please provide the full code along with reject that worked for you. You've mentioned you were able to hide the panel. Can you please provide me the code where you were able to hide the panel?

0 Karma

cmerriman
Super Champion

the code at the top is what i used. If it isn't working for you, I'm not entirely sure why, because it works for me.

 <panel rejects="$hide_panel$">
   <chart>
      <title>Average % CPU Utilization</title>
      <search>
        <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
        <done>
            <condition match="'job.resultCount' == 0">
              <set token="hide_panel">true</set>
            </condition>
          </done>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
      <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.text">Percent</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisTitleY2.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisY2.enabled">0</option>
      <option name="charting.axisY2.scale">inherit</option>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.bubbleMaximumSize">50</option>
      <option name="charting.chart.bubbleMinimumSize">10</option>
      <option name="charting.chart.bubbleSizeBy">area</option>
      <option name="charting.chart.nullValueMode">connect</option>
      <option name="charting.chart.showDataLabels">none</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">top</option>
    </chart>
  </panel>
0 Karma

smuppava
Explorer

Thank you cmerriman for the above code. This code hides the panel although my search results are displayed.

I would like to hide my dashboard panel ONLY when my search results are zero. Currently, I do have search results displayed and your above code hides the panel although the search results are NOT zero.

Can you please tell me what is wrong in here?

Thx for your help,

0 Karma

cmerriman
Super Champion

you may need to add the unset code back in underneath the set condition.

<condition>
        <unset token="hide_panel"></unset>
     </condition>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...