Dashboards & Visualizations
Highlighted

In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Motivator

I have a dashbaord with a number of panels.

Some panels return results. Some don't — No results found. .

Can I remove the panels that say No results found.?

I am thinking of some code or way of doing it dynamically or as the dashboard is drawn.

Alternatively, I can just run the dashboard, note the ones to be removed and then remove them.

Example of a No results found. panel in the dashboard.
alt text

Possible related questions:
https://answers.splunk.com/answers/79155/remove-empty-panels-after-a-search.html
https://answers.splunk.com/answers/590872/how-can-i-showhide-panels-dynamically-with-tokens.html
https://answers.splunk.com/answers/687286/in-a-splunk-dashboard-can-i-have-all-the-panels-in.html

EDIT1

This is what I tried. The panel still shows saying no results found!. I want to hide or not display this. Any ideas?

How does it work? Am I setting showpanel token the correct way? I am setting it inside the progress/condition tags. I presume that , once run, this sets the token `showpanel, and this is then somehow passed to thedepends="$show_panel$"`, which determines if the panel is displayed or not. Is my understanding correct?

  <row depends="$show_panel$">
    <panel>
      <title>Test 123 - I want to hide this as it results in - no results found!</title>
      <table>
        <search id="search_logic">
          <query>
              index=core ....
            </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
             <progress>
                   <condition match="'job.resultCount' == 0">
                         <set token="show_panel">true</set>
                   </condition>
              </progress>
        </search>
      </table>
    </panel>
  </row>

EDIT2

This is the Splunk dashboard that that link refers to if I am not mistaken. I can't find what you are referring to, unless I am missing something. The other dashboard examples I can think of is Splunk 6.x Dashboard examples but I can't find the token reference in there either.

alt text

EDIT3

This is the code from the example mentioned below in the quotes. and this works for me.
But My follow on question is do you need 1 token per chart you want to do it on? Initially I am thinking yes. but may ask the question elsewhere.

   <dashboard>
      <label>Null Search Swapper - show_hide_panels_that_have_no_results_found</label>
      <description>show_hide_panels_that_have_no_results_found</description>
      <row>
        <panel>
          <title>Search Logic Based on Result Count</title>
          <input type="radio" token="index_switcher">
             <label>Choose Index</label>
             <choice value="index=_internal">index=_internal</choice>
             <choice value="index=_null">index=_null</choice>
             <initialValue>index=_null</initialValue>
          </input>
            <search id="search_logic">
              <query>$index_switcher$ |  top sourcetype</query>
              <earliest>-60m@m</earliest>
              <latest>now</latest>

          <!-- Progress event has access to job properties only -->
          <progress>
            <condition match="'job.resultCount' == 0">
              <set token="show_html">foob</set>
            </condition>
            <condition>
              <unset token="show_html"/>
            </condition>
          </progress>
        </search>
      <chart rejects="$show_html$">
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
      </html>
    </panel>
  </row>
</dashboard>
Tags (2)
0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Super Champion

you should be able to use depends in the XML in conjunction with

<progress>
      <condition match="'job.resultCount' == 0">
            <set token="show_panel">true</set>
      </condition>
 </progress>

This doc has a great reference for you. It also has a link to the dashboard examples app which also has an example of this use case.

View solution in original post

Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Motivator

tks, can I ask which specific example in the dashboard examples is it? I had a quick search and it did not jump out at me. I will keep looking.

0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Super Champion

Token viewer (basic). It’s towards the bottom of the page on the examples tab

Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Motivator

see my edit 2 above. I cannot find that example. Or maybe I am mistaken? tks

0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Super Champion

i thought i had commented back on this, but i guess it didn't save. i think you're on an older version of the xml dashboard examples app. what version of splunk are you running? is it possible for you to update the app and/or splunk? Advanced XML has been deprecated, because of that (and that Splunkbase has a different version of the app UI), i'm pretty sure that is an older version and it might now have this example on it. the example in the most recent version of the app is called "Null Search Swapper"
https://splunkbase.splunk.com/app/1603/

0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Motivator

yep I have that dashboard examples. Splunk 6.x Dashboard Examples. But I still could not find the example you referred to in the examples provided.

Token Customization
    Custome Token definitions
    Dynamic tokens from drilldown and change 
    View what tokens are available 
    Custom token links 
0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Motivator

tks, I finally found the code in the example "Null Search Swapper".
And it works for me. Although it is only 1 graph. Do I need 1 token per graph? May ask this question elsewhere.

0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Esteemed Legend

Add rejects="$job.resultCount$==0" to your panel definition (NOTE: have not tested).

0 Karma
Highlighted

Re: In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

Motivator

how do i do that to my panel definition?
something like:

    <progress>
    <set rejects="$job.resultCount$==0">
    </set>
  </progress>

I am guessing here as I cannot find anything on the panel definition. And rejects is wrong here becasuse I get Unknown attribute "rejects" for node "condition"

Is that not what I am doing in my above code in edit 1 of my question?

0 Karma