I have 3 rows with 3 panels in each row. If the 1st panel has no data, the row will hide itself. I have another row on top of the 3 rows displaying the title of the 3 rows. So if all the 3 rows are hidden, I would like to hide the row with the title.
In Splunk, can I use depends="$row1$,$row2$,$row3$"
?
<row depends="$hide_row1$,$hide_row2$,$hide_row3$">
<panel id="header_2">
<html>
<div class="container-header">
<!--<header class="left-header">MAJORS</header>-->
<div>2. INFRASTRUCTURE MONITORING</div>
</div>
</html>
</panel>
</row>
<row depends="$hide_row1$">
<panel>
<title>APPLICATION SERVER</title>
<table id="appServer">
<search>
<query></query>
<earliest>-180m@m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.resultCount' == 0">
<unset token="hide_row1"></unset>
</condition>
<condition>
<set token="hide_row1">true</set>
</condition>
</progress>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Server Name">
<colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Disk Space">
<colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Memory">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
<format type="color" field="CPU">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
</table>
</panel>
$hide_row2$ and $hide_row3$ are about the same as the panel in $hide_row1$.
Apparently, the problem is even if row 2 is not hidden, the header is hidden as well.
@louisawang please try out below run anywhere dashboard
based on Splunk's Internal
log (log_level values are INFO
, ERROR
and WARN
. You can use any other value for testing to return 0 count for specific log_level. For example change INFO
to INFO1
).
It uses an independent search to get the tokens from remaining three panels and decide the tokens to hide/show each of the panel rows as well the header row depending on whether all other 3 rows are hidden or not. Please try out and confimr.
PS: Other option to do the same without independent search would be to use Simple XML JS Extension with SplunkJS stack.
<dashboard>
<label>Hide Row Depending on Other 3 Rows</label>
<!-- Independent search to set show/hide tokens based on Search results from three rows-->
<search>
<query>| makeresults
| fields - _time
| eval hidden_Row1="$hidden_Row1$", hidden_Row2="$hidden_Row2$",hidden_Row3="$hidden_Row3$"
| eval show_row1=case(hidden_Row1=="false","true"),
show_row2=case(hidden_Row2=="false","true"),
show_row3=case(hidden_Row3=="false","true"),
show_header=case(hidden_Row1=="false" OR hidden_Row2=="false" OR hidden_Row3=="false","true")
</query>
<done>
<eval token="tokShowRow1">case($result.show_row1$=="true","true")</eval>
<eval token="tokShowRow2">case($result.show_row2$=="true","true")</eval>
<eval token="tokShowRow3">case($result.show_row3$=="true","true")</eval>
<eval token="tokShowHeader">case($result.show_header$=="true","true")</eval>
</done>
</search>
<row depends="$tokShowHeader$">
<panel id="header_2">
<html>
<div class="container-header">
<!--<header class="left-header">MAJORS</header>-->
<div>2. INFRASTRUCTURE MONITORING</div>
</div>
</html>
</panel>
</row>
<row depends="$tokShowRow1$">
<panel>
<title>Splunk Internal INFO Logs</title>
<table>
<search>
<query>index=_internal sourcetype=splunkd log_level=INFO
| head 1
| table _time _raw
</query>
<earliest>-1h@h</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hidden_Row1">true</set>
</condition>
<condition>
<set token="hidden_Row1">false</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
<row depends="$tokShowRow2$">
<panel>
<title>Splunk Internal WARN Logs</title>
<table>
<search>
<query>index=_internal sourcetype=splunkd log_level=WARN
| head 1
| table _time _raw
</query>
<earliest>-1h@h</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hidden_Row2">true</set>
</condition>
<condition>
<set token="hidden_Row2">false</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
<row depends="$tokShowRow3$">
<panel>
<title>Splunk Internal ERROR Logs</title>
<table>
<search>
<query>index=_internal sourcetype=splunkd log_level=ERROR
| head 1
| table _time _raw
</query>
<earliest>-1h@h</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' == 0">
<set token="hidden_Row3">true</set>
</condition>
<condition>
<set token="hidden_Row3">false</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
</dashboard>
Hi @louisawang
If any of the panels contains data then heading gets displayed otherwise it won't. Please check your token whether you had unset correctly.
Working as expected
<dashboard>
<label>hidepanel</label>
<row depends="$hide_row1$,$hide_row2$,$hide_row3$">
<panel id="header_2">
<html>
<div class="container-header">
<!--<header class="left-header">MAJORS</header>-->
<div>2. INFRASTRUCTURE MONITORING</div>
</div>
</html>
</panel>
</row>
<row depends="$hide_row1$">
<panel>
<title>APPLICATION SERVER1</title>
<table id="appServer">
<search>
<query>index=_internal host="rk"</query>
<earliest>-180m@m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.resultCount' == 0">
<unset token="hide_row1"></unset>
</condition>
<condition>
<set token="hide_row1">true</set>
</condition>
</progress>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Server Name">
<colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Disk Space">
<colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Memory">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
<format type="color" field="CPU">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
</table>
</panel>
</row>
<row depends="$hide_row2$">
<panel>
<title>APPLICATION SERVER2</title>
<table id="appServer2">
<search>
<query>index=_internal </query>
<earliest>-180m@m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.resultCount' == 0">
<unset token="hide_row2"></unset>
</condition>
<condition>
<set token="hide_row2">true</set>
</condition>
</progress>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Server Name">
<colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Disk Space">
<colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Memory">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
<format type="color" field="CPU">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
</table>
</panel>
</row>
<row depends="$hide_row3$">
<panel>
<title>APPLICATION SERVER3</title>
<table id="appServer3">
<search>
<query>index=_internal </query>
<earliest>-180m@m</earliest>
<latest>now</latest>
<progress>
<condition match="'job.resultCount' == 0">
<unset token="hide_row3"></unset>
</condition>
<condition>
<set token="hide_row3">true</set>
</condition>
</progress>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Server Name">
<colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Disk Space">
<colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
</format>
<format type="color" field="Memory">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
<format type="color" field="CPU">
<colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Hi @louisawang
You can use
refer my sample