Dashboards & Visualizations

Showing panel only if in multiple selection menu is selected 1 value (not all)

andreafebbo
Communicator

Hi all!
I have a dashboard with 2 panels, one general and the other one with some details.
Since is pointless to show those details if in the multiple selection menu is selected more than one elemet, I'd like to hide hide the panel in that case.

I think its pointless for me to paste some code in this case.

Thank you!

gcusello
SplunkTrust
SplunkTrust

hi andreafebbo,
in this question there is your answer https://answers.splunk.com/answers/218623/how-to-hide-panels-with-no-results-from-a-dashboar.html
Bye.
Giuseppe

0 Karma

andreafebbo
Communicator

Ciao Giuseppe!
This solution is good if i have to count the result of the search that produces my multiple value selector, anyway i need to count the selected items.

any idea on how to do that?

Grazie

0 Karma

gcusello
SplunkTrust
SplunkTrust

If the condition in in the same search of the panel, as you can see in the related answer, you have to insert a condition in the progress section and the depends option in the panel tag:

<panel depends="$panel_show$">
           <chart>
             <title>My title</title>
             <search>
               <query>your_search | table _time field1 fields2 ...</query>
               <earliest>-60s@s</earliest>
               <latest>now</latest>   
           <progress>
                <condition match="'job.resultCount' > 1">
                    <set token="panel_show">true</set>
                </condition>
                <condition>
                    <unset token="panel_show"/>
                </condition>
            </progress> 
             </search>
...

If instead the condition in in an outside search you have to build something like this

<panel>
          <search id="search_logic">
            <query>your_external_search"</query>
            <!-- Progress event has access to job properties only -->
            <progress>
              <condition match="'job.resultCount' > 1">
                <set token="show_panel">foob</set>
              </condition>
              <condition>
                <unset token="show_panel"></unset>
              </condition>
            </progress>
          </search>
          <chart rejects="$show_panel$">
            <title>your_title</title>
            <search>
            <query>your_search | table _time field1 fields2 </query>
...

Ciao.
Giuseppe

0 Karma

andreafebbo
Communicator

my code is like this:

    </input>
    <input type="multiselect" token="j" searchWhenChanged="true">
      <label>Job</label>
      <choice value="*">All</choice>
      <initialValue>*</initialValue>
      <fieldForLabel>Job_Name</fieldForLabel>
      <fieldForValue>Job_Name</fieldForValue>
      <search>
        <query>sourcetype=bla source=bla| stats count by Job_Name</query>
        <earliest>$t.earliest$</earliest>
        <latest>$t.latest$</latest>
        <progress>
          <condition match="'job.resultCount' = 1 ">
            <set token="panel_show">true</set>
          </condition>
          <condition>
            <unset token="panel_show"></unset>
          </condition>
        </progress>
      </search>
      <delimiter> OR </delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
    </input>

if I put a dummy conditions in "condition match" the dashboard correctly hide and show the panel.
anyway with the true condition it does not work. I think that, once again, it counts the query results and not the selected items.

I need to show the panel when just one item, execept "All" ( * ), is selected.

Thank you for your help

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...