All Apps and Add-ons

How to change panel height from 230px to 10px if result count = 0?

subtrakt
Contributor

Hi!
Is there a way to change panel height from 230px to 10px if result count = 0? All of my searches have an appendpipe at the end so if there are no results, the chart is blank. I would like to save dashboard real-estate if possible when there is nothing to display!

... | appendpipe [stats count | eval NoResults="" | where count=0 | fields - count]

When "NoResults" occurs, I would like to change from "230px" to "10px" in the following param.

230px

Is that possible?

0 Karma

somesoni2
Revered Legend

Try something like this

<view autoCancelInterval="90" isPersistable="true" isSticky="true" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>Dynamic Height</label> 
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>   
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module> 
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>

  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="Search" layoutPanel="panel_row1_col1" >
      <param name="search">
        <![CDATA[
index=_internal earliest=-1h@h | stats count by sourcetype, source | eventstats count as total | eval height=if(total>0,"230px","10px")
            ]]>
      </param>
      <module name="ResultsValueSetter">
        <param name="fields">total,height</param>
        <module name="PostProcess">
          <param name="search">
            | fields - total,height
          </param>
          <module name="HiddenChartFormatter">
            <param name="charting.secondaryAxisTitle.text">Count</param>
            <param name="charting.chart">column</param>
            <param name="charting.chart.stackMode">stacked</param>
            <param name="charting.showMarkers">true</param>
            <param name="charting.chart.nullValueMode">zero</param>
            <param name="charting.legend.placement">bottom</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">$height$</param>
            </module>        
          </module> 
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

sideview
SplunkTrust
SplunkTrust

Does this work? It would be a nice surprise if Splunk had updated its FlashChart module to accept $foo$ tokens anywhere -- ie if it listened to your $height$ in the height param. It would surprise me though.

0 Karma

subtrakt
Contributor

When the count is 0 the NoEvents field comes in so the chart stays uniform with the rest of the charts.

Would this work and still be able to push to the dashboard ResultsValueSetter module? When append pipe kicks-in all the other fields go away and i don't think the height field will stay to push to the dashboard module.

(dddd is there so i can force NoEvents)

index=cisco dddd | eval height=if(isnotnull(NothingToReport),"25px","230px") | timechart count by index | appendpipe [stats count | eval NoEvents="" | where count=0 | fields - count ]

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...