Currently my dashboard panel is hidden even when the search results are displayed.
I would like my dashboard panel to be hidden ONLY when the search results are zero and my panel should be displayed when the search results are displayed. How can I incorporate code for it?
<chart>
<title>Average % CPU Utilization</title>
<search>
<query>index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</condition>
</done>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Percent</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
Hi,
I tried to run your code in my system, and the logic between is perfectly fine.
The only issue I can see here is in your Search Query. Try to run the query and see if it's really giving you desired Non-zero value.
Hi smuppava,
You should download the Splunk 6 Dashboard Examples (https://splunkbase.splunk.com/app/1603/) and see the "Null Search Swapper" App.
It's described how to solve your need.
Every way, in the following example there are two situation: one with results and one without results:
<dashboard>
<label>Null Search Swapper</label>
<row>
<panel>
<title>Search Logic Based on Result Count</title>
<input type="radio" token="index_switcher">
<label>Choose Index</label>
<choice value="index=_internal">index=_internal</choice>
<choice value="index=_null">index=_null</choice>
<initialValue>index=_null</initialValue>
</input>
<search id="search_logic">
<query>$index_switcher$ | top sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<!-- Progress event has access to job properties only -->
<progress>
<condition match="$job.resultCount$ == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
</progress>
</search>
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
</panel>
</row>
</dashboard>
Bye.
Giuseppe
Yeah..I've tried the above code. So, what happens is that my panel is hidden no matter the search results appear or not.
But, in my specific case, I would want my panel to be hidden ONLY when the search results do NOT display any results.
Any suggestions?
This is an example to create both the situations (results, no results), you have to see the "progress" tag to understand hot to configure your search.
In details:
with the <condition match="$job.resultCount$ == 0">
you have the situation with no results, in this case you show an html message.
Instead of the searches of the example, you have to insert your search and manage the two situations with che $job.resultCount$ token.
Bye.
Giuseppe
I still have't found a solution or a way for my code to work. Can I open a case for this issue?
I need to hide the dashboard panel ONLY when search results are zero. Currently, my dashboard is been hidden although search results are displayed.
Below is my code..please do take a look..
<title>Average % CPU Utilization</title>
<search>
<query>index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</done>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Percent</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
The provided dashboard example works perfectly fine. What I can see from your code is that neither your panel nor chart option have either depends
or rejects
set.
cheers, MuS
What version of Splunk Enterprise are you running? It must be at least 6.3 in order to use the features you are trying to use.
I am using Splunk Version 6.3.2
Yes, I am using rejects in my code. But, currently my panel is hidden although search results are NOT zero. I want my panel to be hidden only when the search results are "ZERO".
I've also tried using the below code too, but doesn't work..
<chart>
<title>Average % CPU Utilization</title>
<search>
<query>index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P<ec2cpu>[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<progress>
<condition match="'job.resultCount' == 0">
<set token="hide_panel">true</set>
</condition>
<condition>
<unset token="hide_panel"></unset>
</condition>
</progress>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.text">Percent</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">radialGauge</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">connect</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">top</option>
</chart>
</panel>
That will likely not work. I much rather prefer using either <done>
or <finalized>
, not <progress>
.
I am sorry but I cannot see anything else obviously wrong. with the code.
I would be curious to see if it works if you upgrade, but that is not necessarily something you can just do.
Yes, I've tried done, but still doesn't work in my case. Is there a way to hide the panel when the search doesn't display any results.
Any other suggestions. This question is still NOT resolved.
The below code got cut off..which is above the chart
At minimum you should have the following in the panel definition if you are running 6.3 or newer.
<panel rejects="$hide_panel$">
Please post the entire panel code, including the start of it (depends parameter?)
**
ellipsisNone
0
visible
Percent
visible
visible
linear
linear
0
inherit
radialGauge
50
10
area
connect
none
0.01
default
shiny
all
0
0
ellipsisMiddle
top