Splunk Search

How do I hide a panel in my dashboard that is displaying "no results found" and that is being populated by a base search?

adale25
Engager

I have successfully implemented hiding panels in a dashboard that I'm not using base searches. But, when I apply the same logic to a base search run dashboard, I'm not getting the expected results.

Any clues as to why this is?

0 Karma
1 Solution

Vijeta
Influencer

In your base search query you can use the below code to set and unset tokens, based on which you can add depends to your panel that needs to be hidden

<done>
            <condition match="'job.resultCount' >0">
                <set token="show">true</set>
            </condition>
            <condition>
                <unset token="show"/>
            </condition>
        </done>

View solution in original post

DalJeanis
Legend

Not sure what you mean by a "base search run dashboard".

A base search does not have to be in a displayable location. If you are getting inconsistent results when the base search is inside a panel, then move it outside the panel, and use a postprocessing search (doing nothing) with that as the base search. within the panel.

0 Karma

adale25
Engager

Hi DalJeanis,
I've actually had to remove the base search from my dashboard, that was the only way that this could work for me. Thanks for your input on this!

0 Karma

Vijeta
Influencer

In your base search query you can use the below code to set and unset tokens, based on which you can add depends to your panel that needs to be hidden

<done>
            <condition match="'job.resultCount' >0">
                <set token="show">true</set>
            </condition>
            <condition>
                <unset token="show"/>
            </condition>
        </done>

adale25
Engager

Hi Vijeta,
The above code isn't working for me. When I apply this to my search string it hides panels even if they have content. I've tried this with using the "done" tag, like you had specified, as well as using the "progress" tag, and still no luck. Please see my code below. Thanks!

    <panel depends="$panel_show$">
      <table>
        <title>Top 5 Count of CPU Utilization &gt; 80% by Host</title>
        <search base="indexos">
          <query>| where Percent_CPU_Load &gt; 80
| stats count by host
| sort - count
|  head 5</query>
          <done>
            <condition match="'job.resultCount' &gt; 0">
              <set token="panel_show">true</set>
            </condition>
            <condition>
              <unset token="panel_show"></unset>
            </condition>
          </done>
        </search>
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...