How do I hide panel when "no results found" text is displayed on dashboard

[smuppava]

How do I hide my dashboard when I see "no results found" text displayed on my dashboard? I tried the code given by Splunk team on this website, but still didn't work.

Below is my code and doesn't hide the dashboard. I do see "no results found" text on my dashboard instead. Please do provide your inputs.

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
        </progress>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>

Thx for your help

[dbcase]

Try this

<search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>

[sundareshr]

Try setting the tokens when <done> OR <finalized>, not <progress>

<done>
    <condition match="match('job.resultCount' == 0)">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </done

[smuppava]

My dashboard panel is hidden right now although I do have search results.

I want my panel to be hidden ONLY when the search results are zero..can you please help?

Below is the code I am using

< panel rejects ="$hide_panel$">

index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)\w | ^:" |stats avg(ec2cpu) as EC2_CPUUtilization
$field1.earliest$
$field1.latest$


true

[gokadroid]

your Panel start tag is missing in the sample code. Can you check If you have this there when Panel tag begins:

  <panel depends="$hide_panel$">

[cmerriman]

do you have a depends statement? It may have been cut off? Also, set the token when job.resultCount=0, try that.

 <panel rejects="$hide_panel$">
  <chart>
     <title>Average % CPU Utilization</title>
     <search>
       <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
       <earliest>$field1.earliest$</earliest>
       <latest>$field1.latest$</latest>
       <done>
           <condition match="'job.resultCount' == 0">
             <set token="hide_panel">true</set>
           </condition>
         </done>
     </search>
     <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
     <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
     <option name="charting.axisTitleX.visibility">visible</option>
     <option name="charting.axisTitleY.text">Percent</option>
     <option name="charting.axisTitleY.visibility">visible</option>
     <option name="charting.axisTitleY2.visibility">visible</option>
     <option name="charting.axisX.scale">linear</option>
     <option name="charting.axisY.scale">linear</option>
     <option name="charting.axisY2.enabled">0</option>
     <option name="charting.axisY2.scale">inherit</option>
     <option name="charting.chart">radialGauge</option>
     <option name="charting.chart.bubbleMaximumSize">50</option>
     <option name="charting.chart.bubbleMinimumSize">10</option>
     <option name="charting.chart.bubbleSizeBy">area</option>
     <option name="charting.chart.nullValueMode">connect</option>
     <option name="charting.chart.showDataLabels">none</option>
     <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
     <option name="charting.chart.stackMode">default</option>
     <option name="charting.chart.style">shiny</option>
     <option name="charting.drilldown">all</option>
     <option name="charting.layout.splitSeries">0</option>
     <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
     <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
     <option name="charting.legend.placement">top</option>
   </chart>
 </panel>

[smuppava]

Yes, I do have a depends statement in my code, got cut off during my cut paste.

This is my code..

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
        </progress>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>

[smuppava]

Tried the below suggestion and still doesn't hide my panel..

you should set the code when the resultcount is 0

<progress>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

below is my updated code:

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
    <condition match="'job.resultCount'== 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

[cmerriman]

see my updated syntax at the top.

[smuppava]

depends was used above chart..

Still doesn't work..can you tell me if I could use reject instead of depend? can you please help me with how reject could be used within my code?

[smuppava]

Follow your comments and the panel is still not hidden, below is my code: Based on your code, you need to switch the set and unset lines. You should be setting the token when job.resultCount is not 0. Unless you are using rejects instead of depends, but you said you are using depends

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' != 0">
            <unset token="hide_panel"></unset>
            </condition>
          <condition>
             <set token="hide_panel">true</set>
          </condition>
        </progress>

[cmerriman]

you should set the token when the resultcount is 0

   <progress>
       <condition match="'job.resultCount' == 0">
         <set token="hide_panel">true</set>
         </condition>
       <condition>
          <unset token="hide_panel"></unset>
       </condition>
     </progress>

[smuppava]

Tried your updated syntax, but my panel is still NOT hidden and I still do see the same result "no result found" on my panel...

---

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
       <progress>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

---

[cmerriman]

I changed depends to reject and also changed <progress> to <done> while also removing the <condition> <unset token="hide_panel"></unset> </condition>

I tried it on a test dashboard and got it to hide the panel when empty and show the panel when there were results.

[smuppava]

Add the below reject for the above code before chart as well..

[smuppava]

I tried the above as you've suggested and still didn't work. Am I doing anything wrong here?

---

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
       <done>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
          </done>
    </search>

[cmerriman]

You have <panel rejects="$hide_panel$"> ?

[smuppava]

Didn't you want me to use reject instead of depends? Can you please provide the full code along with reject that worked for you. You've mentioned you were able to hide the panel. Can you please provide me the code where you were able to hide the panel?

[cmerriman]

the code at the top is what i used. If it isn't working for you, I'm not entirely sure why, because it works for me.

 <panel rejects="$hide_panel$">
   <chart>
      <title>Average % CPU Utilization</title>
      <search>
        <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
        <done>
            <condition match="'job.resultCount' == 0">
              <set token="hide_panel">true</set>
            </condition>
          </done>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
      <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.text">Percent</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisTitleY2.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisY2.enabled">0</option>
      <option name="charting.axisY2.scale">inherit</option>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.bubbleMaximumSize">50</option>
      <option name="charting.chart.bubbleMinimumSize">10</option>
      <option name="charting.chart.bubbleSizeBy">area</option>
      <option name="charting.chart.nullValueMode">connect</option>
      <option name="charting.chart.showDataLabels">none</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">top</option>
    </chart>
  </panel>

[gemrose]

I am looking for hide solution in timechart instead of stats.

|timechart count span=1d partial=false

[ITWhisperer]

The same solution should work

  <row rejects="$hide_panel$">
    <panel>
      <table>
        <search>
          <done>
            <condition match="'job.resultCount' == 0">
              <set token="hide_panel">true</set>
            </condition>
            <condition>
              <unset token="hide_panel"></unset>
            </condition>
          </done>
          <query>| makeresults 
| timechart count span=1d partial=f</query>
          <earliest>0</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>