Dashboards & Visualizations

How do you hide more than one panel with with "No results found"?

UMDTERPS
Communicator

I am trying to hide panels that say, "No results found."
About a half dozen threads on Splunk Answers mention the below code to hide panels:

<panel depends="$panel_show$">
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>

The issue is, the above XML hides any panel regardless of what it returns. Others in the half a dozen Splunk Answers threads mention the same issue. I created a simple dashboard to test the code:

<dashboard>
  <label>Hide dashboard test</label>
  <row>
    <panel depends="$panel_show$">
      <title>This panel has results</title>
      <table>
        <search>
          <query>| makeresults 
| eval a=1
| table a</query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
    <panel depends="$panel_show$">
      <title>This panel has "No results found"</title>
      <table>
        <search>
          <query>| makeresults 
| eval a=a+1
| table a</query>
          <earliest>0</earliest>
          <latest></latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
              <unset token="panel_hide"></unset>
            </condition>
            <condition>
              <set token="panel_hide">true</set>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</dashboard>

I also tried the code on clones of production dashboards and got the same results as well, all panels hide regardless of what it returns.

Has anyone figured this out? =(

Thanks!

0 Karma
1 Solution

Vijeta
Influencer

@UMDTERPS your token name in both the panels is same, therefore when panel 1 token are set , they are getting unset by panel 2 causing both the panels to hide as final value of token panel_show is unset. You should try by using panel_show1 and panel_hide1 as token names in panel 1 and panel_show2 , panel_hide2 token names for panel 2.

View solution in original post

0 Karma

nabeel652
Builder

Put your conditions under <done> </done> instead of <progress></progress> and it will work.

However @Vijeta is right. your token will cause both panels to disappear as you're using same token name.

<dashboard>
   <label>Hide dashboard test</label>
   <row>
     <panel depends="$panel_show$">
       <title>This panel has results</title>
       <table>
         <search>
           <query>| makeresults 
 | eval a=1
 | table a  </query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <condition match="'job.resultCount' > 0">
               <set token="panel_show">true</set>
               <unset token="panel_hide"></unset>
             </condition>
             <condition>
               <set token="panel_hide">true</set>
               <unset token="panel_show"></unset>
             </condition>
           </done>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
     <panel depends="$panel_show$">
       <title>This panel has "No results found"</title>
       <table>
         <search>
           <query>| makeresults 
 | eval a=a+1
 | table a</query>
           <earliest>0</earliest>
           <latest></latest>
           <done>
             <condition match="'job.resultCount' > 0">
               <set token="panel_show">true</set>
               <unset token="panel_hide"></unset>
             </condition>
             <condition>
               <set token="panel_hide">true</set>
               <unset token="panel_show"></unset>
             </condition>
           </done>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma

UMDTERPS
Communicator

It appears progress works, however what is the difference between the "progress" and "done" tag?

0 Karma

paviach
New Member

Worked fine for me. Thanks!

0 Karma

UMDTERPS
Communicator

Also, this works slighly better because it has less XML? (The token is not set and unset again like my first example)

 <panel depends="$panel_show3$">

                    <progress>
            <condition match="'job.resultCount' &gt; 0">
              <set token="panel_show3">true</set>
            </condition>
            <condition>
              <unset token="panel_show3"></unset>
            </condition>
          </progress>
0 Karma

Vijeta
Influencer

@UMDTERPS your token name in both the panels is same, therefore when panel 1 token are set , they are getting unset by panel 2 causing both the panels to hide as final value of token panel_show is unset. You should try by using panel_show1 and panel_hide1 as token names in panel 1 and panel_show2 , panel_hide2 token names for panel 2.

0 Karma

UMDTERPS
Communicator

That works, THANKS1 😃

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...