Hi!
Is there a way to change panel height from 230px to 10px if result count = 0? All of my searches have an appendpipe at the end so if there are no results, the chart is blank. I would like to save dashboard real-estate if possible when there is nothing to display!
... | appendpipe [stats count | eval NoResults="" | where count=0 | fields - count]
When "NoResults" occurs, I would like to change from "230px" to "10px" in the following param.
Is that possible?
Try something like this
<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
<label>Dynamic Height</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
<module name="Search" layoutPanel="panel_row1_col1" >
<param name="search">
<![CDATA[
index=_internal earliest=-1h@h | stats count by sourcetype, source | eventstats count as total | eval height=if(total>0,"230px","10px")
]]>
</param>
<module name="ResultsValueSetter">
<param name="fields">total,height</param>
<module name="PostProcess">
<param name="search">
| fields - total,height
</param>
<module name="HiddenChartFormatter">
<param name="charting.secondaryAxisTitle.text">Count</param>
<param name="charting.chart">column</param>
<param name="charting.chart.stackMode">stacked</param>
<param name="charting.showMarkers">true</param>
<param name="charting.chart.nullValueMode">zero</param>
<param name="charting.legend.placement">bottom</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">$height$</param>
</module>
</module>
</module>
</module>
</module>
</module>
</view>
Does this work? It would be a nice surprise if Splunk had updated its FlashChart module to accept $foo$ tokens anywhere -- ie if it listened to your $height$ in the height param. It would surprise me though.
When the count is 0 the NoEvents field comes in so the chart stays uniform with the rest of the charts.
Would this work and still be able to push to the dashboard ResultsValueSetter module? When append pipe kicks-in all the other fields go away and i don't think the height field will stay to push to the dashboard module.
(dddd is there so i can force NoEvents)
index=cisco dddd | eval height=if(isnotnull(NothingToReport),"25px","230px") | timechart count by index | appendpipe [stats count | eval NoEvents="" | where count=0 | fields - count ]