Dashboards & Visualizations

How do I hide panel when "no results found" text is displayed on dashboard

Explorer

How do I hide my dashboard when I see "no results found" text displayed on my dashboard? I tried the code given by Splunk team on this website, but still didn't work.

Below is my code and doesn't hide the dashboard. I do see "no results found" text on my dashboard instead. Please do provide your inputs.

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
        </progress>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>

Thx for your help

Motivator

Try this

<search id="search_logic">
      <query>$index_switcher$ |  top sourcetype</query>
      <earliest>-60m@m</earliest>
      <latest>now</latest>

      <progress>
           <!-- match attribute for condition uses eval-like expression (see Splunk search language 'eval' command) -->
           <!-- logic: if resultCount is 0, then show a static html element, and hide the chart element -->
           <condition match="'job.resultCount' == 0">
               <set token="show_html">true</set>
           </condition>
           <condition>
               <unset token="show_html"/>
           </condition>
       </progress>
   </search>
0 Karma

Legend

Try setting the tokens when <done> OR <finalized>, not <progress>

<done>
    <condition match="match('job.resultCount' == 0)">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </done
0 Karma

Explorer

My dashboard panel is hidden right now although I do have search results.

I want my panel to be hidden ONLY when the search results are zero..can you please help?

Below is the code I am using

< panel rejects ="$hide_panel$">

Average % CPU Utilization

index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)\w | ^:" |stats avg(ec2cpu) as EC2_CPUUtilization
$field1.earliest$
$field1.latest$


true





0 Karma

Motivator

your Panel start tag is missing in the sample code. Can you check If you have this there when Panel tag begins:

  <panel depends="$hide_panel$">
0 Karma

Super Champion

do you have a depends statement? It may have been cut off? Also, set the token when job.resultCount=0, try that.

 <panel rejects="$hide_panel$">
  <chart>
     <title>Average % CPU Utilization</title>
     <search>
       <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
       <earliest>$field1.earliest$</earliest>
       <latest>$field1.latest$</latest>
       <done>
           <condition match="'job.resultCount' == 0">
             <set token="hide_panel">true</set>
           </condition>
         </done>
     </search>
     <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
     <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
     <option name="charting.axisTitleX.visibility">visible</option>
     <option name="charting.axisTitleY.text">Percent</option>
     <option name="charting.axisTitleY.visibility">visible</option>
     <option name="charting.axisTitleY2.visibility">visible</option>
     <option name="charting.axisX.scale">linear</option>
     <option name="charting.axisY.scale">linear</option>
     <option name="charting.axisY2.enabled">0</option>
     <option name="charting.axisY2.scale">inherit</option>
     <option name="charting.chart">radialGauge</option>
     <option name="charting.chart.bubbleMaximumSize">50</option>
     <option name="charting.chart.bubbleMinimumSize">10</option>
     <option name="charting.chart.bubbleSizeBy">area</option>
     <option name="charting.chart.nullValueMode">connect</option>
     <option name="charting.chart.showDataLabels">none</option>
     <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
     <option name="charting.chart.stackMode">default</option>
     <option name="charting.chart.style">shiny</option>
     <option name="charting.drilldown">all</option>
     <option name="charting.layout.splitSeries">0</option>
     <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
     <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
     <option name="charting.legend.placement">top</option>
   </chart>
 </panel>
0 Karma

Explorer

Yes, I do have a depends statement in my code, got cut off during my cut paste.

This is my code..

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
            <unset token="hide_panel"></unset>
          </condition>
          <condition>
            <set token="hide_panel">true</set>
          </condition>
        </progress>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>
0 Karma

Explorer

Tried the below suggestion and still doesn't hide my panel..

you should set the code when the resultcount is 0

<progress>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

below is my updated code:

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
    <condition match="'job.resultCount'== 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>
0 Karma

Super Champion

see my updated syntax at the top.

0 Karma

Explorer

depends was used above chart..

Still doesn't work..can you tell me if I could use reject instead of depend? can you please help me with how reject could be used within my code?

0 Karma

Explorer

Follow your comments and the panel is still not hidden, below is my code: Based on your code, you need to switch the set and unset lines. You should be setting the token when job.resultCount is not 0. Unless you are using rejects instead of depends, but you said you are using depends

  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' != 0">
            <unset token="hide_panel"></unset>
            </condition>
          <condition>
             <set token="hide_panel">true</set>
          </condition>
        </progress>
0 Karma

Super Champion

you should set the token when the resultcount is 0

   <progress>
       <condition match="'job.resultCount' == 0">
         <set token="hide_panel">true</set>
         </condition>
       <condition>
          <unset token="hide_panel"></unset>
       </condition>
     </progress>
0 Karma

Explorer

Tried your updated syntax, but my panel is still NOT hidden and I still do see the same result "no result found" on my panel...


  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
       <progress>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
    <condition>
       <unset token="hide_panel"></unset>
    </condition>
  </progress>

0 Karma

Super Champion

I changed depends to reject and also changed <progress> to <done> while also removing the <condition> <unset token="hide_panel"></unset> </condition>

I tried it on a test dashboard and got it to hide the panel when empty and show the panel when there were results.

0 Karma

Explorer

Add the below reject for the above code before chart as well..

0 Karma

Explorer

I tried the above as you've suggested and still didn't work. Am I doing anything wrong here?


  <chart>
    <title>Top % Disk Space Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(Host-TopDiskSpaceUsageByPercent-Percent)[\w | ^:](?P&lt;topdisk&gt;[\w]+)" |stats avg(topdisk) as TopDiskSpaceUsage</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
       <done>
    <condition match="'job.resultCount' == 0">
      <set token="hide_panel">true</set>
      </condition>
          </done>
    </search>
0 Karma

Super Champion

You have <panel rejects="$hide_panel$"> ?

0 Karma

Explorer

Didn't you want me to use reject instead of depends? Can you please provide the full code along with reject that worked for you. You've mentioned you were able to hide the panel. Can you please provide me the code where you were able to hide the panel?

0 Karma

Super Champion

the code at the top is what i used. If it isn't working for you, I'm not entirely sure why, because it works for me.

 <panel rejects="$hide_panel$">
   <chart>
      <title>Average % CPU Utilization</title>
      <search>
        <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
        <done>
            <condition match="'job.resultCount' == 0">
              <set token="hide_panel">true</set>
            </condition>
          </done>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
      <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
      <option name="charting.axisTitleX.visibility">visible</option>
      <option name="charting.axisTitleY.text">Percent</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisTitleY2.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.axisY2.enabled">0</option>
      <option name="charting.axisY2.scale">inherit</option>
      <option name="charting.chart">radialGauge</option>
      <option name="charting.chart.bubbleMaximumSize">50</option>
      <option name="charting.chart.bubbleMinimumSize">10</option>
      <option name="charting.chart.bubbleSizeBy">area</option>
      <option name="charting.chart.nullValueMode">connect</option>
      <option name="charting.chart.showDataLabels">none</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">top</option>
    </chart>
  </panel>
0 Karma

Explorer

Thank you cmerriman for the above code. This code hides the panel although my search results are displayed.

I would like to hide my dashboard panel ONLY when my search results are zero. Currently, I do have search results displayed and your above code hides the panel although the search results are NOT zero.

Can you please tell me what is wrong in here?

Thx for your help,

0 Karma

Super Champion

you may need to add the unset code back in underneath the set condition.

<condition>
        <unset token="hide_panel"></unset>
     </condition>
0 Karma