Dashboards & Visualizations

How to hide a chart if all values are zero.

alistairmcdouga
Explorer

I have reached a a situation where I had a timechart for a set of fields where some fields are usually always zero, however the rest of the fields are large numbers. When these usually zero fields have a value it is typically very small, and to prevent this occasional low value being lost in the masses of large values on the same chart, it was decided to move this low value into a separate chart showing the same time x-axis but having its own independent y-axis. However, as this separated chart is usually a flat line of zeros, I want to be able to hide the chart when there is no non-zero values, and show the chart if values appear. I have tried using the following condition to hide the chart:

<condition match="'job.resultCount' > 0">
    <set token="panel_show">true</set>
</condition>
<condition>
    <unset token="panel_show"></unset>
</condition>

However, as the timechart does has valid rows, but the values are zero it will always set the token=true.

How, do you hide the chart when there are no non-zero values?

0 Karma
1 Solution

alistairmcdouga
Explorer

After some experimenting and reading related questions I solved this problem by a slightly indirect route, hence writting up this question/answer to help anyone running into the same issue, and to see if there is a better alternative way to achieve the same result.

As indicated in the question, I found that due to the rows for the chart being real rows, the conditional check for resultCount would always be true, and therefore never hide the panel. Therefore, by using an additional always hidden single value panel, I performed a sum of all the values that go into the timechart and only keep the result if the sum of all values is > 0 (or, != or <, whatever your use case requires), this panel can then have a conditional statement of match="'job.resultCount' > 0" to set a token that is used to hide the other chart based. I've produced a complete demo dashboard to show how this works:

<form>
  <label>Hide Flat Timechart Demo</label>
  <description>Demo to show how to hide a timechart when all input values are zeros.</description>
  <fieldset submitButton="false">
    <input type="dropdown" token="val_a">
      <label>second chart value</label>
      <choice value="a">visible (value=a)</choice>
      <choice value="b">hidden (value=b)</choice>
      <default>a</default>
      <initialValue>a</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Never Hidden</title>
        <search>
          <query>
            | makeresults 
            | eval a=1
            | timechart span=1h count AS a
            | fields _time, $val_a$
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Always hidden</title>
      <single depends="$hidden$">
        <search base="may_be_hidden">
          <query>
            | stats sum(a) AS number
            | where number > 0
          </query>
          <done>
            <condition match=" 'job.resultCount' > 0 ">
              <set token="show_chart_b">true</set>
            </condition>
            <condition>
              <unset token="show_chart_b">true</unset>
            </condition>
          </done>
        </search>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$show_chart_b$">
        <title>Sometimes Hidden</title>
        <search id="may_be_hidden">
          <query>
            | makeresults 
            | eval a=1
            | timechart span=1h count AS a
            | fields _time, $val_a$
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

alistairmcdouga
Explorer

After some experimenting and reading related questions I solved this problem by a slightly indirect route, hence writting up this question/answer to help anyone running into the same issue, and to see if there is a better alternative way to achieve the same result.

As indicated in the question, I found that due to the rows for the chart being real rows, the conditional check for resultCount would always be true, and therefore never hide the panel. Therefore, by using an additional always hidden single value panel, I performed a sum of all the values that go into the timechart and only keep the result if the sum of all values is > 0 (or, != or <, whatever your use case requires), this panel can then have a conditional statement of match="'job.resultCount' > 0" to set a token that is used to hide the other chart based. I've produced a complete demo dashboard to show how this works:

<form>
  <label>Hide Flat Timechart Demo</label>
  <description>Demo to show how to hide a timechart when all input values are zeros.</description>
  <fieldset submitButton="false">
    <input type="dropdown" token="val_a">
      <label>second chart value</label>
      <choice value="a">visible (value=a)</choice>
      <choice value="b">hidden (value=b)</choice>
      <default>a</default>
      <initialValue>a</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Never Hidden</title>
        <search>
          <query>
            | makeresults 
            | eval a=1
            | timechart span=1h count AS a
            | fields _time, $val_a$
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Always hidden</title>
      <single depends="$hidden$">
        <search base="may_be_hidden">
          <query>
            | stats sum(a) AS number
            | where number > 0
          </query>
          <done>
            <condition match=" 'job.resultCount' > 0 ">
              <set token="show_chart_b">true</set>
            </condition>
            <condition>
              <unset token="show_chart_b">true</unset>
            </condition>
          </done>
        </search>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <chart depends="$show_chart_b$">
        <title>Sometimes Hidden</title>
        <search id="may_be_hidden">
          <query>
            | makeresults 
            | eval a=1
            | timechart span=1h count AS a
            | fields _time, $val_a$
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...