Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to hide dashboard panel results until search i...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Splunk Community.
We have a dashboard with 8 panels. The dashboard has 2 text boxes where we can use to enter start date with time and end date with time & it also has a drop down to select the panel we want. I would like to hide the dashboard results until search is complete and then display the results. Now the issue is .. it is hiding the results when we first open a dashboard and enter the inputs (Start and end date)
but when we switch the panels it didn't work. It only works for the first time . Here is the code I'm using.
<panel rejects="$hide_progress_panel$">
<html>
<p align="center">Loading, please wait...</p>
</html>
</panel>
</row>
<row>
<panel depends="$Apple-details$,$hide_progress_panel$">
--
<finalized>
<set token="hide_progress_panel">true</set>
</finalized>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@iamsplunker31 try the following code block to your existing search. When the search query runs the token should be unset using <progress> Search Event Handler and only when the search completes it should be set using <done> Search Event Handler.
PS: <finalized> search event handler has been deprecated since Splunk Enterprise 6.4.
<progress>
<unset token="hide_progress_panel"></unset>
</progress>
<done>
<set token="hide_progress_panel">true</set>
</done>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for crediting the BEST answer by @niketnilay.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this:
<html>
<p align="center">Loading, please wait...</p>
</html>
</panel>
<progress>
<unset token="hide_progress_panel"></unset>
</progress>
<done>
<set token="hide_progress_panel">true</set>
</done>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @woodcock.
It worked.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@woodcock small correction, closing node for <unset> should be </unset> not </set>
<unset token="hide_progress_panel"></unset>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good point; I fixed it. And I see that you posted the same answer (without the typo) shortly before I did, so really, @iamsplunker31, you should UnAccept my answer and Accept the one from @niketnilay.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@iamsplunker31 try the following code block to your existing search. When the search query runs the token should be unset using <progress> Search Event Handler and only when the search completes it should be set using <done> Search Event Handler.
PS: <finalized> search event handler has been deprecated since Splunk Enterprise 6.4.
<progress>
<unset token="hide_progress_panel"></unset>
</progress>
<done>
<set token="hide_progress_panel">true</set>
</done>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a requirement to hide the results from a panel until search is not complete. WHen I am using below, it is hiding the panel until result is not coming.
Can you please suggest how can I see the pannel but, not the results until search is not complete.
<panel depends="$hide_progress_panel$">
<table>
<search>
<query>index="_internal"
|table *</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<progress>
<unset token="hide_progress_panel"></unset>
</progress>
<done>
<set token="hide_progress_panel">true</set>
</done>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @niketnilay. This resolves my issue
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
