Dashboards & Visualizations

How do you hide more than one panel with with "No results found"?

UMDTERPS
Communicator

I am trying to hide panels that say, "No results found."
About a half dozen threads on Splunk Answers mention the below code to hide panels:

<panel depends="$panel_show$">
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>

The issue is, the above XML hides any panel regardless of what it returns. Others in the half a dozen Splunk Answers threads mention the same issue. I created a simple dashboard to test the code:

<dashboard>
  <label>Hide dashboard test</label>
  <row>
    <panel depends="$panel_show$">
      <title>This panel has results</title>
      <table>
        <search>
          <query>| makeresults 
| eval a=1
| table a</query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$panel_show$">
      <title>This panel has "No results found"</title>
      <table>
        <search>
          <query>| makeresults 
| eval a=a+1
| table a</query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

I also tried the code on clones of production dashboards and got the same results as well, all panels hide regardless of what it returns.

Has anyone figured this out? =(

Thanks!

0 Karma
1 Solution

Vijeta
Influencer

@UMDTERPS your token name in both the panels is same, therefore when panel 1 token are set , they are getting unset by panel 2 causing both the panels to hide as final value of token panel_show is unset. You should try by using panel_show1 and panel_hide1 as token names in panel 1 and panel_show2 , panel_hide2 token names for panel 2.

View solution in original post

0 Karma

nabeel652
Builder

Put your conditions under <done> </done> instead of <progress></progress> and it will work.

However @Vijeta is right. your token will cause both panels to disappear as you're using same token name.

<dashboard>
   <label>Hide dashboard test</label>
   <row>
     <panel depends="$panel_show$">
       <title>This panel has results</title>
       <table>
         <search>
           <query>| makeresults 
 | eval a=1
 | table a  </query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <condition match="'job.resultCount' > 0">
               <set token="panel_show">true</set>
               <unset token="panel_hide"></unset>
             </condition>
             <condition>
               <set token="panel_hide">true</set>
               <unset token="panel_show"></unset>
             </condition>
           </done>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
     <panel depends="$panel_show$">
       <title>This panel has "No results found"</title>
       <table>
         <search>
           <query>| makeresults 
 | eval a=a+1
 | table a</query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <condition match="'job.resultCount' > 0">
               <set token="panel_show">true</set>
               <unset token="panel_hide"></unset>
             </condition>
             <condition>
               <set token="panel_hide">true</set>
               <unset token="panel_show"></unset>
             </condition>
           </done>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma

UMDTERPS
Communicator

It appears progress works, however what is the difference between the "progress" and "done" tag?

0 Karma

paviach
New Member

Worked fine for me. Thanks!

0 Karma

UMDTERPS
Communicator

Also, this works slighly better because it has less XML? (The token is not set and unset again like my first example)

 <panel depends="$panel_show3$">

                    <progress>
            <condition match="'job.resultCount' &gt; 0">
              <set token="panel_show3">true</set>
            </condition>
            <condition>
              <unset token="panel_show3"></unset>
            </condition>
          </progress>
0 Karma

Vijeta
Influencer

@UMDTERPS your token name in both the panels is same, therefore when panel 1 token are set , they are getting unset by panel 2 causing both the panels to hide as final value of token panel_show is unset. You should try by using panel_show1 and panel_hide1 as token names in panel 1 and panel_show2 , panel_hide2 token names for panel 2.

0 Karma

UMDTERPS
Communicator

That works, THANKS1 😃

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...