In that case, try this (this is just a brain dump, please review and tweak as needed)
<dashboard>
<search id="panel_logic">
<query>... base search ... NOT (Status="OK")</query>
<earliest>@d</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="show_error">true</set>
<unset token="exec_search" />
</condition>
<condition>
<unset token="show_error" />
<set token="exec_search">yes</set>
</condition>
</done>
</search>
<!--- this is the panel with query for success ONLY with 2 columns-->
<panel rejects="$show_error$>
<table>
<search>
...
</table>
<!--- this is the panel with query for success AND failure with 3 columns-->
<panel depends="$show_error$>
<table>
<search>
...
</table>
Now, depends & rejects will only show/hide the panel if criteria is met, the search for the panel will executE, resulting in 3 searches in your dashboard. to minimize the number of times search gets executed, add the following to the respective searches. This will cause the search to wait for these specific tokens to be set. You can hide these fields from final display.
Search for success only add eval exec_search="$exec_search$"
Search for error condition add, eval show_error="$show_error$"
... View more
