Dashboards & Visualizations

How do you hide more than one panel with with "No results found"?

UMDTERPS
Communicator

I am trying to hide panels that say, "No results found."
About a half dozen threads on Splunk Answers mention the below code to hide panels:

<panel depends="$panel_show$">
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>

The issue is, the above XML hides any panel regardless of what it returns. Others in the half a dozen Splunk Answers threads mention the same issue. I created a simple dashboard to test the code:

<dashboard>
  <label>Hide dashboard test</label>
  <row>
    <panel depends="$panel_show$">
      <title>This panel has results</title>
      <table>
        <search>
          <query>| makeresults 
| eval a=1
| table a</query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$panel_show$">
      <title>This panel has "No results found"</title>
      <table>
        <search>
          <query>| makeresults 
| eval a=a+1
| table a</query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

I also tried the code on clones of production dashboards and got the same results as well, all panels hide regardless of what it returns.

Has anyone figured this out? =(

Thanks!

0 Karma
1 Solution

Vijeta
Influencer

@UMDTERPS your token name in both the panels is same, therefore when panel 1 token are set , they are getting unset by panel 2 causing both the panels to hide as final value of token panel_show is unset. You should try by using panel_show1 and panel_hide1 as token names in panel 1 and panel_show2 , panel_hide2 token names for panel 2.

View solution in original post

0 Karma

nabeel652
Builder

Put your conditions under <done> </done> instead of <progress></progress> and it will work.

However @Vijeta is right. your token will cause both panels to disappear as you're using same token name.

<dashboard>
   <label>Hide dashboard test</label>
   <row>
     <panel depends="$panel_show$">
       <title>This panel has results</title>
       <table>
         <search>
           <query>| makeresults 
 | eval a=1
 | table a  </query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <condition match="'job.resultCount' > 0">
               <set token="panel_show">true</set>
               <unset token="panel_hide"></unset>
             </condition>
             <condition>
               <set token="panel_hide">true</set>
               <unset token="panel_show"></unset>
             </condition>
           </done>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
     <panel depends="$panel_show$">
       <title>This panel has "No results found"</title>
       <table>
         <search>
           <query>| makeresults 
 | eval a=a+1
 | table a</query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <condition match="'job.resultCount' > 0">
               <set token="panel_show">true</set>
               <unset token="panel_hide"></unset>
             </condition>
             <condition>
               <set token="panel_hide">true</set>
               <unset token="panel_show"></unset>
             </condition>
           </done>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma

UMDTERPS
Communicator

It appears progress works, however what is the difference between the "progress" and "done" tag?

0 Karma

paviach
New Member

Worked fine for me. Thanks!

0 Karma

UMDTERPS
Communicator

Also, this works slighly better because it has less XML? (The token is not set and unset again like my first example)

 <panel depends="$panel_show3$">

                    <progress>
            <condition match="'job.resultCount' &gt; 0">
              <set token="panel_show3">true</set>
            </condition>
            <condition>
              <unset token="panel_show3"></unset>
            </condition>
          </progress>
0 Karma

Vijeta
Influencer

@UMDTERPS your token name in both the panels is same, therefore when panel 1 token are set , they are getting unset by panel 2 causing both the panels to hide as final value of token panel_show is unset. You should try by using panel_show1 and panel_hide1 as token names in panel 1 and panel_show2 , panel_hide2 token names for panel 2.

0 Karma

UMDTERPS
Communicator

That works, THANKS1 😃

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...