Dashboards & Visualizations

How to hide panels based on a search condition

jkreddy
Engager

I want to hide panels based on search string output. My panels are single and chart.

Tags (2)

MuS
SplunkTrust
SplunkTrust

Hi jkreddy,

take at this run everywhere example which will only show a dashboard panel if there are results from the search:

<dashboard>
  <row>
    <panel depends="$panel_show$">
      <chart>
        <title>index=_internal search over the last 5 seconds</title>
        <search id="mySearch">
          <query>index=_internal  sourcetype=splunkd | timechart span=1sec count by sourcetype</query>
          <earliest>-5s@s</earliest>
          <latest>now</latest>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show">true</set>
            </condition>
            <condition>
              <unset token="panel_show"></unset>
            </condition>
          </progress>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>
        <option name="refresh.auto.interval">5</option>
      </chart>
    </panel>
  </row>
</dashboard>

Adapt the search to your needs and change the <condition match="'job.resultCount' &gt; 0"> to match your condition.

Hope this helps ...

cheers, MuS

cwolfe1
New Member

This was exactly what I was looking for. Thank you!

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...