Dashboards & Visualizations

How to create a single value with panel_depends?

Mike6960
Path Finder

Hi,

 

I have dashboard with multiple panels. Some of them I succeeded to only show them when there is a result. Now I would like this also for some single value vis. 

The single value displays '0' when no result. But still is showing in the dashboard. How can I fix this?

    </panel>

    <panel depends="$panel_show4$">

      <title>Test_Panel_4</title>

      <single>

        <search>

          <progress>

            <condition match="'job.resultCount' &gt; 0">

              <set token="panel_show4">true</set>

            </condition>

            <condition>

              <unset token="panel_show4"></unset>

            </condition>

          </progress>

Labels (3)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Mike6960 

Can you please try this?

<row>
    <panel depends="$panel_show4$">
      <single>
        <search>
          <done>
            <condition match="'job.resultCount' &gt; 0">
              <set token="panel_show4">true</set>
            </condition>
            <condition>
              <unset token="panel_show4"></unset>
            </condition>
          </done>
          <query>YOUR_SEARCH</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </single>
    </panel>
  </row>

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma

Mike6960
Path Finder

@kamlesh_vaghela  Hi, sadly this does not make a difference. I suspect that it has something to do with the fact that splunk 'sees' the '0' in the single value as a result

Tags (1)
0 Karma

Mike6960
Path Finder

Hi, I am not sure what is different in your suggestion. 

 

I have this:

<panel depends="$panel_show4$">
<title>Test</title>
<single>
<search>
<progress>
<condition match="'job.resultCount' &gt; 0">
<set token="panel_show4">true</set>
</condition>
<condition>
<unset token="panel_show4"></unset>
</condition>
</progress>
<query>My Search</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="rangeColors">["0x555","0xdc4e41"]</option>
<option name="rangeValues">[0]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@kamlesh_vaghela uses <done> rather than <progress> - <done> is a more reliable way of determining when there are final results. For example, if the first part of your search finds results which are later removed by subsequent parts of your search, you may get a result count > 0 from <progress> which ends up as 0 in <done>

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...