feat(dashboard): zero line when no data found

[soleksy-splunk]

Issue number:
https://splunk.atlassian.net/browse/ADDON-76195

PR Type

What kind of change does this PR introduce?

• Feature
• Bug Fix
• Refactoring (no functional or API changes)
• Documentation Update
• Maintenance (dependency updates, CI, etc.)

Summary

Zero line is displayed when no data found for all dashboard charts, except those in resource tab.

Pros:

• zero line chart displayed instead of information 'No data found"

Cons:

• it definitely will generate some costs due to it making some computations to generate default zero data, but comparing to general search operations it should be negligible, as even for whole previous year it generates event every 5 min and locally it takes about 0,12 sec, plus query is cached to 10 min, so if there aren't real time queries it shouldn't generate more computations even after page refreshes.

Sum up:
Comparing to data search this operation shouldn't be a problem.

Some info regarding Smart Sources (https://splunkui.splunk.com/Packages/dashboard-docs/Smartsources ).

enableSmartSourceDS: true,

it is a feature that enables referencing already finished search jobs and its results inside next searches (here it is used to verify if there are any results for table data, if not then default values are applied if there are next code is ignored).

Changes

For data charts where "No data found" message is displayed there is displayed chart with zero line, simulating none of the events to appear.

User experience

Please describe the user experience before and after this change. Screenshots are welcome for additional context.

Overview before changes:

Overview after changes:

Data Ingestion tab before changes:

Data Ingestion tab after changes:

Error tab before changes:

Error tab after changes:

Tables for errors is filled with 0 data when data volume found but number of events got no data.

Resource consumption tab after changes remains the same:

Checklist

If an item doesn't apply to your changes, leave it unchecked.

• I have performed a self-review of this change according to the development guidelines
• Tests have been added/modified to cover the changes (testing doc)
• Changes are documented
• PR title and description follows the contributing principles

[vtsvetkov-splunk]

LGTM (I have no understanding of the magic symbol combination). Could you add more context to the description what changed high level? I see you enabled smart search. It would be nice to see the reasoning, what the pros and cons of this. Would it work slower/faster; cost more/less

[soleksy-splunk]

LGTM (I have no understanding of the magic symbol combination). Could you add more context to the description what changed high level? I see you enabled smart search. It would be nice to see the reasoning, what the pros and cons of this. Would it work slower/faster; cost more/less

I added some more descriptions, let me know if thats enough.

Generally the benefit is it looks a bit better but cons are only some potential cost, which should be close to 0, as those are static computations in the end.