Splunk Dev

Dashboard XML Hiding/Displaying Panels

jjburke306
Loves-to-Learn Lots

Hi all,

I have been trying to create a Dashboard for searches based on a specific ID number (this is intended to help team members find connected data, who aren't proficient in writing searches). The panels are backed by  some extensive search macros. Anyways, this is a two part question regarding XML development:

First, I was wondering if there was a way via XML to check against null return on the search, so that I can hide panels that return nothing, and display only those which return a value from the search?

Second, how would one actually go about using XML to hide panels or display panels, in the case that a search returns no results or a valid result?  Thank you.

Labels (1)
Tags (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Panels can be shown/hidden depending on the presence of a token. This token could be set/unset based on the number of results in the query of the panel

 

<panel depends="$results1$">
...

 

0 Karma

jjburke306
Loves-to-Learn Lots

Hi there,

How would you go about actually checking for a certain number of results?

Thanks

0 Karma

jjburke306
Loves-to-Learn Lots
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
   <search>
          <query>...</query>
          <earliest>...</earliest>
          <latest>..</latest>
          <done>
            <set token="search_results">$job.resultCount$</set>
          </done>
    </search>
0 Karma

jjburke306
Loves-to-Learn Lots

Thx a ton. @ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...