I have a dashbaord with a number of panels.
Some panels return results. Some don't — No results found. .
Can I remove the panels that say No results found.?
I am thinking of some code or way of doing it dynamically or as the dashboard is drawn.
Alternatively, I can just run the dashboard, note the ones to be removed and then remove them.
Example of a No results found. panel in the dashboard.
Possible related questions:
https://answers.splunk.com/answers/79155/remove-empty-panels-after-a-search.html
https://answers.splunk.com/answers/590872/how-can-i-showhide-panels-dynamically-with-tokens.html
https://answers.splunk.com/answers/687286/in-a-splunk-dashboard-can-i-have-all-the-panels-in.html
EDIT1
This is what I tried. The panel still shows saying no results found!. I want to hide or not display this. Any ideas?
How does it work? Am I setting show_panel token the correct way? I am setting it inside the progress/condition tags. I presume that , once run, this sets the token show_panel, and this is then somehow passed to the depends="$show_panel$", which determines if the panel is displayed or not. Is my understanding correct?
<row depends="$show_panel$">
<panel>
<title>Test 123 - I want to hide this as it results in - no results found!</title>
<table>
<search id="search_logic">
<query>
index=core ....
</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.resultCount' == 0">
<set token="show_panel">true</set>
</condition>
</progress>
</search>
</table>
</panel>
</row>
EDIT2
This is the Splunk dashboard that that link refers to if I am not mistaken. I can't find what you are referring to, unless I am missing something. The other dashboard examples I can think of is Splunk 6.x Dashboard examples but I can't find the token reference in there either.
EDIT3
This is the code from the example mentioned below in the quotes. and this works for me.
But My follow on question is do you need 1 token per chart you want to do it on? Initially I am thinking yes. but may ask the question elsewhere.
<dashboard>
<label>Null Search Swapper - show_hide_panels_that_have_no_results_found</label>
<description>show_hide_panels_that_have_no_results_found</description>
<row>
<panel>
<title>Search Logic Based on Result Count</title>
<input type="radio" token="index_switcher">
<label>Choose Index</label>
<choice value="index=_internal">index=_internal</choice>
<choice value="index=_null">index=_null</choice>
<initialValue>index=_null</initialValue>
</input>
<search id="search_logic">
<query>$index_switcher$ | top sourcetype</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
<!-- Progress event has access to job properties only -->
<progress>
<condition match="'job.resultCount' == 0">
<set token="show_html">foob</set>
</condition>
<condition>
<unset token="show_html"/>
</condition>
</progress>
</search>
<chart rejects="$show_html$">
<title>Top sourcetypes for index=_internal</title>
<search base="search_logic" />
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
</chart>
<html depends="$show_html$">
<p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
</html>
</panel>
</row>
</dashboard>
Hi HattrickNZ,
a completely different approach would be to use a SPL that will show a text instead of No results found. Here is an example :
index=_internal sourcetype=splunkd use anything here
| stats count by sourcetype
| append
[| stats count
| eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)]
| streamstats count AS line_num
| eval head_num=if(line_num > 1, line_num - 1, 1)
| where NOT ( count=0 AND head_num < line_num )
| table sourcetype count
This will produce something like this if something matches:
Hope this helps ...
cheers, MuS
