I'm not an XML expert, but I do remember seeing similar posts (that I can't find at the moment) on this topic and most of the time, using the depends panel attribute worked. Check out these 2 pages from documentation on this attribute to see if it'll work for your case.
Lets say i have 2 tokens - Token1 and Token2.
<title>Main Table</title> ... ... ... <drilldown> <condition field="Failed"> <set token="Token1 ">$click.value$</set> <set token="Token2 ">$click.value$</set> </condition> </drilldown>
Essentially my 2 tokens will have same values (in this case). How do i write "table depends" section which should do the following ...
a) Token1 will bring up the table (as shown in my first post)
b) Token2 should hide the table if table has no results
<panel> <table depends="$Token1$" "Token2"> <title>Sub-Table</title> <searchString>bla bla bla </searchString> <earliestTime>$field1.earliest$</earliestTime> <latestTime>$field1.latest$</latestTime> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="count">10</option> </table> </panel>
This may not be entirely the same thing but I had an issue where I wanted to only display a set of results if a user selected something on the dropdown menu. Basically I had a summary index and in my dashboard I only wanted to display FPSubLogoff/Sub_Logon columns when they were there in the index. Thought I'd post it here because I was pulling my hair out looking for it 🙂
index=testindex report=IClassLogon Product=$typ$ orighost="$sys$" |eval FPSubLogoffs=if(FPSubLogoffs=0,NULL,FPSubLogoffs)|eval FPSubLogons=if(FPSubLogons=0,NULL,FPSubLogons) | rename orighost as cg |eval Time = strftime(time, "%Y-%m-%d") |timechart span=1d sum(Logons) as "Daily Logons" sum(FPSubLogons) as " Sub Logons" sum(Logoffs) as "Daily Logoffs" sum(FPSub_Logoffs) as " Sub Logoffs" by Product usenull=f
This will hide the panel if the query returns no results.
<panel depends="$hide_panel$"> <chart> <search> <query>sourcetype=*</query> <progress> <condition match="'job.resultCount' == 0"> <unset token="hide_panel"></unset> </condition> <condition> <set token="hide_panel">true</set> </condition> </progress> </search> </chart> </panel>
If you have other visuals within the same panel, the depends can be moved to hide the specific chart like so:
<panel> <chart depends="$hide_panel$">
NICE! Worked like a charm! I have mixed OS panels for Windows and Linux. Sometimes data isn't available due to the OS choice so now those panels just VANISH! Awesome!