Splunk Dev

How do you hide a row depending on 3 rows?

louisawang
New Member

I have 3 rows with 3 panels in each row. If the 1st panel has no data, the row will hide itself. I have another row on top of the 3 rows displaying the title of the 3 rows. So if all the 3 rows are hidden, I would like to hide the row with the title.

In Splunk, can I use depends="$row1$,$row2$,$row3$"?

<row depends="$hide_row1$,$hide_row2$,$hide_row3$">
    <panel id="header_2">
      <html>
        <div class="container-header">
          <!--<header class="left-header">MAJORS</header>-->
            <div>2. INFRASTRUCTURE MONITORING</div>
        </div>          
      </html>
    </panel>
  </row>
  <row depends="$hide_row1$">
    <panel>
      <title>APPLICATION SERVER</title>
      <table id="appServer">
        <search>
          <query></query>
          <earliest>-180m@m</earliest>
          <latest>now</latest>
            <progress>
              <condition match="'job.resultCount' == 0">
                <unset token="hide_row1"></unset>
              </condition>
              <condition>
                <set token="hide_row1">true</set>
              </condition>
            </progress>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <format type="color" field="Server Name">
          <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Disk Space">
          <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="Memory">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
        <format type="color" field="CPU">
          <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
        </format>
      </table>
    </panel>

$hide_row2$ and $hide_row3$ are about the same as the panel in $hide_row1$.

Apparently, the problem is even if row 2 is not hidden, the header is hidden as well.

0 Karma

niketn
Legend

@louisawang please try out below run anywhere dashboard based on Splunk's Internal log (log_level values are INFO, ERROR and WARN. You can use any other value for testing to return 0 count for specific log_level. For example change INFO to INFO1).

It uses an independent search to get the tokens from remaining three panels and decide the tokens to hide/show each of the panel rows as well the header row depending on whether all other 3 rows are hidden or not. Please try out and confimr.
PS: Other option to do the same without independent search would be to use Simple XML JS Extension with SplunkJS stack.

<dashboard>
  <label>Hide Row Depending on Other 3 Rows</label>
  <!-- Independent search to set show/hide tokens based on Search results from three rows-->
  <search>
    <query>| makeresults
| fields - _time
| eval hidden_Row1="$hidden_Row1$", hidden_Row2="$hidden_Row2$",hidden_Row3="$hidden_Row3$" 
| eval show_row1=case(hidden_Row1=="false","true"),
       show_row2=case(hidden_Row2=="false","true"),
       show_row3=case(hidden_Row3=="false","true"),
       show_header=case(hidden_Row1=="false" OR hidden_Row2=="false" OR hidden_Row3=="false","true")
    </query>
    <done>
      <eval token="tokShowRow1">case($result.show_row1$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow2">case($result.show_row2$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowRow3">case($result.show_row3$==&quot;true&quot;,"true")</eval>
      <eval token="tokShowHeader">case($result.show_header$==&quot;true&quot;,"true")</eval>
    </done>
  </search>
  <row depends="$tokShowHeader$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
  </row>
  <row depends="$tokShowRow1$">
    <panel>
      <title>Splunk Internal INFO Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=INFO
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row1">true</set>
           </condition>
           <condition>
             <set token="hidden_Row1">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow2$">
    <panel>
      <title>Splunk Internal WARN Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=WARN
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row2">true</set>
           </condition>
           <condition>
             <set token="hidden_Row2">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
  <row depends="$tokShowRow3$">
    <panel>
      <title>Splunk Internal ERROR Logs</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=ERROR
| head 1
| table _time _raw
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
         <done>
           <condition match="'job.resultCount' == 0">
             <set token="hidden_Row3">true</set>
           </condition>
           <condition>
             <set token="hidden_Row3">false</set>
           </condition>
         </done>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vnravikumar
Champion

Hi @louisawang

If any of the panels contains data then heading gets displayed otherwise it won't. Please check your token whether you had unset correctly.

Working as expected

<dashboard>
  <label>hidepanel</label>
  <row depends="$hide_row1$,$hide_row2$,$hide_row3$">
     <panel id="header_2">
       <html>
         <div class="container-header">
           <!--<header class="left-header">MAJORS</header>-->
             <div>2. INFRASTRUCTURE MONITORING</div>
         </div>          
       </html>
     </panel>
   </row>
   <row depends="$hide_row1$">
     <panel>
       <title>APPLICATION SERVER1</title>
       <table id="appServer">
         <search>
           <query>index=_internal host="rk"</query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row1"></unset>
               </condition>
               <condition>
                 <set token="hide_row1">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row2$">
     <panel>
       <title>APPLICATION SERVER2</title>
       <table id="appServer2">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row2"></unset>
               </condition>
               <condition>
                 <set token="hide_row2">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
<row depends="$hide_row3$">
     <panel>
       <title>APPLICATION SERVER3</title>
       <table id="appServer3">
         <search>
           <query>index=_internal </query>
           <earliest>-180m@m</earliest>
           <latest>now</latest>
             <progress>
               <condition match="'job.resultCount' == 0">
                 <unset token="hide_row3"></unset>
               </condition>
               <condition>
                 <set token="hide_row3">true</set>
               </condition>
             </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
         <format type="color" field="Server Name">
           <colorPalette type="map">{"SOSPRDAPPL002":#FFFFFF,"SOSPRDAPPL004":#FFFFFF,"SOSPRDAPPL006":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Disk Space">
           <colorPalette type="map">{"OK":#FFFFFF,"WARNING":#FFFFFF,"ERROR":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="Memory">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
         <format type="color" field="CPU">
           <colorPalette type="map">{"OK":#FFFFFF}</colorPalette>
         </format>
       </table>
     </panel>
</row>
</dashboard>

vnravikumar
Champion

Hi @louisawang

You can use
refer my sample

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...