Dashboards & Visualizations

How to hide dashboard panel ONLY when search results are zero?

smuppava
Explorer

Currently my dashboard panel is hidden even when the search results are displayed.

I would like my dashboard panel to be hidden ONLY when the search results are zero and my panel should be displayed when the search results are displayed. How can I incorporate code for it?

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <done>
         <condition match="'job.resultCount' == 0">
           <set token="hide_panel">true</set>
         </condition>
        <condition>
     <unset token="hide_panel"></unset>
  </condition>
       </done>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>
0 Karma

ID_SplunkUser
Path Finder

Hi,

I tried to run your code in my system, and the logic between is perfectly fine.
The only issue I can see here is in your Search Query. Try to run the query and see if it's really giving you desired Non-zero value.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi smuppava,
You should download the Splunk 6 Dashboard Examples (https://splunkbase.splunk.com/app/1603/) and see the "Null Search Swapper" App.
It's described how to solve your need.

Every way, in the following example there are two situation: one with results and one without results:

<dashboard>
  <label>Null Search Swapper</label>
  <row>
    <panel>
      <title>Search Logic Based on Result Count</title>
      <input type="radio" token="index_switcher">
         <label>Choose Index</label>
         <choice value="index=_internal">index=_internal</choice>
         <choice value="index=_null">index=_null</choice>
         <initialValue>index=_null</initialValue>
      </input>
        <search id="search_logic">
          <query>$index_switcher$ |  top sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>

          <!-- Progress event has access to job properties only -->
          <progress>
            <condition match="$job.resultCount$ == 0">
              <set token="show_html">foob</set>
            </condition>
            <condition>
              <unset token="show_html"/>
            </condition>
          </progress>
        </search>
      <chart rejects="$show_html$">
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
      </html>
    </panel>
  </row>
</dashboard>

Bye.
Giuseppe

0 Karma

smuppava
Explorer

Yeah..I've tried the above code. So, what happens is that my panel is hidden no matter the search results appear or not.
But, in my specific case, I would want my panel to be hidden ONLY when the search results do NOT display any results.
Any suggestions?

0 Karma

gcusello
SplunkTrust
SplunkTrust

This is an example to create both the situations (results, no results), you have to see the "progress" tag to understand hot to configure your search.
In details:
with the <condition match="$job.resultCount$ == 0"> you have the situation with no results, in this case you show an html message.
Instead of the searches of the example, you have to insert your search and manage the two situations with che $job.resultCount$ token.
Bye.
Giuseppe

0 Karma

smuppava
Explorer

I still have't found a solution or a way for my code to work. Can I open a case for this issue?

I need to hide the dashboard panel ONLY when search results are zero. Currently, my dashboard is been hidden although search results are displayed.

Below is my code..please do take a look..

 <title>Average % CPU Utilization</title>
 <search>
   <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
   <earliest>$field1.earliest$</earliest>
   <latest>$field1.latest$</latest>
   <done>
      <condition match="'job.resultCount' == 0">
        <set token="hide_panel">true</set>
      </condition>
     <condition>
  <unset token="hide_panel"></unset>

    </done>
 </search>
 <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
 <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
 <option name="charting.axisTitleX.visibility">visible</option>
 <option name="charting.axisTitleY.text">Percent</option>
 <option name="charting.axisTitleY.visibility">visible</option>
 <option name="charting.axisTitleY2.visibility">visible</option>
 <option name="charting.axisX.scale">linear</option>
 <option name="charting.axisY.scale">linear</option>
 <option name="charting.axisY2.enabled">0</option>
 <option name="charting.axisY2.scale">inherit</option>
 <option name="charting.chart">radialGauge</option>
 <option name="charting.chart.bubbleMaximumSize">50</option>
 <option name="charting.chart.bubbleMinimumSize">10</option>
 <option name="charting.chart.bubbleSizeBy">area</option>
 <option name="charting.chart.nullValueMode">connect</option>
 <option name="charting.chart.showDataLabels">none</option>
 <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
 <option name="charting.chart.stackMode">default</option>
 <option name="charting.chart.style">shiny</option>
 <option name="charting.drilldown">all</option>
 <option name="charting.layout.splitSeries">0</option>
 <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
 <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
 <option name="charting.legend.placement">top</option>
 </chart>
</panel>
0 Karma

MuS
SplunkTrust
SplunkTrust

The provided dashboard example works perfectly fine. What I can see from your code is that neither your panel nor chart option have either depends or rejects set.

cheers, MuS

0 Karma

rjthibod
Champion

What version of Splunk Enterprise are you running? It must be at least 6.3 in order to use the features you are trying to use.

0 Karma

smuppava
Explorer

I am using Splunk Version 6.3.2

0 Karma

smuppava
Explorer

Yes, I am using rejects in my code. But, currently my panel is hidden although search results are NOT zero. I want my panel to be hidden only when the search results are "ZERO".

0 Karma

smuppava
Explorer

I've also tried using the below code too, but doesn't work..

  <chart>
    <title>Average % CPU Utilization</title>
    <search>
      <query>index=eapi_cloud_system_qa  $appname$  sourcetype=monitor OR sourcetype=monitor_log  |rex field=_raw "(EC2-CPUUtilization-Percent)[\w | ^:](?P&lt;ec2cpu&gt;[\w]+)" |stats avg(ec2cpu) as EC2_CPUUtilization</query>
      <earliest>$field1.earliest$</earliest>
      <latest>$field1.latest$</latest>
      <progress>
          <condition match="'job.resultCount' == 0">
             <set token="hide_panel">true</set>
          </condition>
          <condition>
           <unset token="hide_panel"></unset>
          </condition>
        </progress>
      </search>
      <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.text">Percent</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">radialGauge</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">connect</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">all</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.placement">top</option>
  </chart>
</panel>
0 Karma

rjthibod
Champion

That will likely not work. I much rather prefer using either <done> or <finalized>, not <progress>.

I am sorry but I cannot see anything else obviously wrong. with the code.

I would be curious to see if it works if you upgrade, but that is not necessarily something you can just do.

0 Karma

smuppava
Explorer

Yes, I've tried done, but still doesn't work in my case. Is there a way to hide the panel when the search doesn't display any results.
Any other suggestions. This question is still NOT resolved.

0 Karma

smuppava
Explorer

The below code got cut off..which is above the chart

0 Karma

rjthibod
Champion

At minimum you should have the following in the panel definition if you are running 6.3 or newer.

<panel rejects="$hide_panel$">

0 Karma

ehudb
Contributor

Please post the entire panel code, including the start of it (depends parameter?)

0 Karma

smuppava
Explorer

**

CPU

Average % CPU Utilization

index=eapi_cloud_system_qa $appname$ sourcetype=monitor OR sourcetype=monitor_log |rex field=_raw "(EC2-CPUUtilization-Percent)\w | ^:" |stats avg(ec2cpu) as EC2_CPUUtilization
$field1.earliest$
$field1.latest$


true






ellipsisNone
0
visible
Percent
visible
visible
linear
linear
0
inherit
radialGauge
50
10
area
connect
none
0.01
default
shiny
all
0
0
ellipsisMiddle
top

**

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...