Dashboards & Visualizations

In a dashboard, how can I remove the panels that say "No results found." with code or something equivalent?

HattrickNZ
Motivator

I have a dashbaord with a number of panels.

Some panels return results. Some don't — No results found. .

Can I remove the panels that say No results found.?

I am thinking of some code or way of doing it dynamically or as the dashboard is drawn.

Alternatively, I can just run the dashboard, note the ones to be removed and then remove them.

Example of a No results found. panel in the dashboard.
alt text

Possible related questions:
https://answers.splunk.com/answers/79155/remove-empty-panels-after-a-search.html
https://answers.splunk.com/answers/590872/how-can-i-showhide-panels-dynamically-with-tokens.html
https://answers.splunk.com/answers/687286/in-a-splunk-dashboard-can-i-have-all-the-panels-in.html

EDIT1

This is what I tried. The panel still shows saying no results found!. I want to hide or not display this. Any ideas?

How does it work? Am I setting show_panel token the correct way? I am setting it inside the progress/condition tags. I presume that , once run, this sets the token show_panel, and this is then somehow passed to the depends="$show_panel$", which determines if the panel is displayed or not. Is my understanding correct?

  <row depends="$show_panel$">
    <panel>
      <title>Test 123 - I want to hide this as it results in - no results found!</title>
      <table>
        <search id="search_logic">
          <query>
              index=core ....
            </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
             <progress>
                   <condition match="'job.resultCount' == 0">
                         <set token="show_panel">true</set>
                   </condition>
              </progress>
        </search>
      </table>
    </panel>
  </row>

EDIT2

This is the Splunk dashboard that that link refers to if I am not mistaken. I can't find what you are referring to, unless I am missing something. The other dashboard examples I can think of is Splunk 6.x Dashboard examples but I can't find the token reference in there either.

alt text

EDIT3

This is the code from the example mentioned below in the quotes. and this works for me.
But My follow on question is do you need 1 token per chart you want to do it on? Initially I am thinking yes. but may ask the question elsewhere.

   <dashboard>
      <label>Null Search Swapper - show_hide_panels_that_have_no_results_found</label>
      <description>show_hide_panels_that_have_no_results_found</description>
      <row>
        <panel>
          <title>Search Logic Based on Result Count</title>
          <input type="radio" token="index_switcher">
             <label>Choose Index</label>
             <choice value="index=_internal">index=_internal</choice>
             <choice value="index=_null">index=_null</choice>
             <initialValue>index=_null</initialValue>
          </input>
            <search id="search_logic">
              <query>$index_switcher$ |  top sourcetype</query>
              <earliest>-60m@m</earliest>
              <latest>now</latest>

          <!-- Progress event has access to job properties only -->
          <progress>
            <condition match="'job.resultCount' == 0">
              <set token="show_html">foob</set>
            </condition>
            <condition>
              <unset token="show_html"/>
            </condition>
          </progress>
        </search>
      <chart rejects="$show_html$">
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
      </chart>
      <html depends="$show_html$">
         <p style="color:blue;margin-left:30px;font-size:14px">Search returned no results, so we've hidden the chart!</p>
      </html>
    </panel>
  </row>
</dashboard>
Tags (2)
0 Karma
1 Solution

cmerriman
Super Champion

you should be able to use depends in the XML in conjunction with

<progress>
      <condition match="'job.resultCount' == 0">
            <set token="show_panel">true</set>
      </condition>
 </progress>

This doc has a great reference for you. It also has a link to the dashboard examples app which also has an example of this use case.

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi HattrickNZ,

a completely different approach would be to use a SPL that will show a text instead of No results found. Here is an example :

index=_internal sourcetype=splunkd use anything here 
 | stats count by sourcetype 
 | append 
     [| stats count 
     | eval sourcetype=if(isnull(sourcetype), "Nothing to see here, move along!", sourcetype)] 
 | streamstats count AS line_num 
 | eval head_num=if(line_num > 1, line_num - 1, 1) 
 | where NOT ( count=0 AND head_num < line_num ) 
 | table sourcetype count

This will produce something like this if something matches:
alt text

Hope this helps ...

cheers, MuS

0 Karma

woodcock
Esteemed Legend

Add rejects="$job.resultCount$==0" to your panel definition (NOTE: have not tested).

0 Karma

HattrickNZ
Motivator

how do i do that to my panel definition?
something like:

    <progress>
    <set rejects="$job.resultCount$==0">
    </set>
  </progress>

I am guessing here as I cannot find anything on the panel definition. And rejects is wrong here becasuse I get Unknown attribute "rejects" for node "condition"

Is that not what I am doing in my above code in edit 1 of my question?

0 Karma

cmerriman
Super Champion

he is saying to do it in the panel node.

<panel rejects="$job.resultCount$==0">
0 Karma

woodcock
Esteemed Legend

Right, exactly.

0 Karma

cmerriman
Super Champion

you should be able to use depends in the XML in conjunction with

<progress>
      <condition match="'job.resultCount' == 0">
            <set token="show_panel">true</set>
      </condition>
 </progress>

This doc has a great reference for you. It also has a link to the dashboard examples app which also has an example of this use case.

View solution in original post

Nextbeat
Path Finder

To get it to work, I had to add an unset condition along with a set conditional so that when it did find events, the table would appear:

 

 

<table depends="$show_panel$">
        <search>
          <query></query>
          <progress>
            <condition match="'job.resultCount'==0">
               <unset token="show_panel">true</unset>
            </condition>
            <condition>
              <set token="show_panel"></set>
            </condition>
          </progress>
        </search>
</table>

 

 




0 Karma

HattrickNZ
Motivator

tks, can I ask which specific example in the dashboard examples is it? I had a quick search and it did not jump out at me. I will keep looking.

0 Karma

cmerriman
Super Champion

Token viewer (basic). It’s towards the bottom of the page on the examples tab

HattrickNZ
Motivator

see my edit 2 above. I cannot find that example. Or maybe I am mistaken? tks

0 Karma

cmerriman
Super Champion

i thought i had commented back on this, but i guess it didn't save. i think you're on an older version of the xml dashboard examples app. what version of splunk are you running? is it possible for you to update the app and/or splunk? Advanced XML has been deprecated, because of that (and that Splunkbase has a different version of the app UI), i'm pretty sure that is an older version and it might now have this example on it. the example in the most recent version of the app is called "Null Search Swapper"
https://splunkbase.splunk.com/app/1603/

0 Karma

HattrickNZ
Motivator

yep I have that dashboard examples. Splunk 6.x Dashboard Examples. But I still could not find the example you referred to in the examples provided.

Token Customization
    Custome Token definitions
    Dynamic tokens from drilldown and change 
    View what tokens are available 
    Custom token links 
0 Karma

HattrickNZ
Motivator

tks, I finally found the code in the example "Null Search Swapper".
And it works for me. Although it is only 1 graph. Do I need 1 token per graph? May ask this question elsewhere.

0 Karma

Nextbeat
Path Finder

For each visualization (table, chart, single, etc.), you'll need to add that code.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!