Dashboards & Visualizations

How to hide Charts/Tables from a Dashboard if there are no results?

kshanky143
Path Finder

Hello

I'm using tokens to pull multiple tables in my dashboard. There are possibilities where the tables have no results (as shown below). When the tables have no results, i would like to hide it. How can i do this ?
alt text

chrisduimstra
Path Finder

This will hide the panel if the query returns no results.

<panel depends="$hide_panel$">
      <chart>
        <search>
          <query>sourcetype=*</query>
          <progress>
            <condition match="'job.resultCount' == 0">
              <unset token="hide_panel"></unset>
            </condition>
            <condition>
              <set token="hide_panel">true</set>
            </condition>
          </progress>
        </search>
      </chart>
    </panel>

If you have other visuals within the same panel, the depends can be moved to hide the specific chart like so:

<panel>
  <chart depends="$hide_panel$">

f5x6kb8
Explorer

NICE! Worked like a charm! I have mixed OS panels for Windows and Linux. Sometimes data isn't available due to the OS choice so now those panels just VANISH! Awesome!

0 Karma

billycote
Path Finder

This may not be entirely the same thing but I had an issue where I wanted to only display a set of results if a user selected something on the dropdown menu. Basically I had a summary index and in my dashboard I only wanted to display FP_Sub_Logoff/Sub_Logon columns when they were there in the index. Thought I'd post it here because I was pulling my hair out looking for it 🙂

index=testindex report=IClassLogon Product=$typ$ orig_host="$sys$" |eval FP_Sub_Logoffs=if(FP_Sub_Logoffs=0,NULL,FP_Sub_Logoffs)|eval FP_Sub_Logons=if(FP_Sub_Logons=0,NULL,FP_Sub_Logons) | rename orig_host as cg |eval Time = strftime(_time, "%Y-%m-%d") |timechart span=1d sum(Logons) as "Daily Logons" sum(FP_Sub_Logons) as " Sub Logons" sum(Logoffs) as "Daily Logoffs" sum(FP_Sub_Logoffs) as " Sub Logoffs" by Product usenull=f

0 Karma

ppablo
Retired

Hi @kshanky143

I'm not an XML expert, but I do remember seeing similar posts (that I can't find at the moment) on this topic and most of the time, using the depends panel attribute worked. Check out these 2 pages from documentation on this attribute to see if it'll work for your case.
http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...
http://docs.splunk.com/Documentation/Splunk/6.2.2/Viz/tokens#Access_tokens_to_show_or_hide_user_inte...

0 Karma

kshanky143
Path Finder

Lets say i have 2 tokens - Token1 and Token2.

<title>Main Table</title>
 ...
 ... 
 ...
 <drilldown>
     <condition field="Failed">
       <set token="Token1 ">$click.value$</set>
       <set token="Token2 ">$click.value$</set>
    </condition>
 </drilldown>

Essentially my 2 tokens will have same values (in this case). How do i write "table depends" section which should do the following ...
a) Token1 will bring up the table (as shown in my first post)
b) Token2 should hide the table if table has no results

<panel>
  <table depends="$Token1$" "Token2">
    <title>Sub-Table</title>
    <searchString>bla bla bla </searchString>
    <earliestTime>$field1.earliest$</earliestTime>
    <latestTime>$field1.latest$</latestTime>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="count">10</option>
  </table>
</panel>
0 Karma

kshanky143
Path Finder

Im already using tokens. How can use multiple tokens to hide the table ?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...