Dashboards & Visualizations

How to hide panels based on a search condition

jkreddy
Engager

I want to hide panels based on search string output. My panels are single and chart.

Tags (2)

MuS
Legend

Hi jkreddy,

take at this run everywhere example which will only show a dashboard panel if there are results from the search:

<dashboard>
  <row>
    <panel depends="$panel_show$">
      <chart>
        <title>index=_internal search over the last 5 seconds</title>
        <search id="mySearch">
          <query>index=_internal  sourcetype=splunkd | timechart span=1sec count by sourcetype</query>
          <earliest>-5s@s</earliest>
          <latest>now</latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
            </condition>
            <condition>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <option name="refresh.auto.interval">5</option>
      </chart>
    </panel>
  </row>
</dashboard>

Adapt the search to your needs and change the <condition match="'job.resultCount' &gt; 0"> to match your condition.

Hope this helps ...

cheers, MuS

cwolfe1
New Member

This was exactly what I was looking for. Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...