Dashboards & Visualizations

Can I generate a show no panel based on a set of criteria?

HattrickNZ
Motivator

If I have a search the gives the following:

alt text

Can I get it to give a No results found. like this panel in a dashbaord, below

alt text

The idea is that I only want to show panels if they are worth looking at.
That is if they have some non-zero values worth looking at.
If No results found. is displayed I have the code to show/hide the panel here, but I cannot generate a No results found. if all the values are zero.

A sample search to play with:

| makeresults 
| eval data = "
1-Sep    0;
2-Sep    0;
" 
 | makemv delim=";" data
 | mvexpand data
 | rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)"
 | fields + Date kpi1 | fields - _time
 |search kpi1 = *
 | eval x=if(max(kpi1)=0,"dontShowPanel","showPanel")
0 Karma

vnravikumar
Champion

Hi @HattrickNZ

If I am not wrong, as per your query you want to show "No results found" when all kpi1 is 0. You can filter the record that is greater than 0. finally you can get "No results found".

| makeresults 
| eval data = "
 1-Sep    0;
 2-Sep    0; 
 " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)" 
| fields + Date kpi1 
| fields - _time 
| where kpi1>0
0 Karma

HattrickNZ
Motivator

tks, that might look like it works, I will check and confirm.

0 Karma

vnravikumar
Champion

Welcome. Please accept if this solution helps you.

0 Karma

niketn
Legend

@vnravikumar this would take out zero values from the chart even when values are there.

@HattrickNZ could you share your current SPL which returns above result?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vnravikumar
Champion

Hi @niketnilay

The following logic will not exclude zero.

Hi @HattrickNZ

Pls try this

| makeresults 
| eval data = "
  1-Sep    0;
  2-Sep    0; 
   3-Sep    1; 
   4-Sep    2; 
   5-Sep    0;
  " 
| makemv delim=";" data 
| mvexpand data 
| rex field=data "(?<Date>\d+-\w+)\s+(?<kpi1>\d+)" 
| fields + Date kpi1 
| fields - _time 
| eventstats sum(kpi1) as kpi1sum 
| where kpi1sum>0 
| table Date,kpi1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...