I want to do something similar to the "Table where rows expand to show more information" in the Splunk 6 Examples App, but I want to do it with sideview Table. I can't find anything that references that functionality in Sideview
Is it possible, or do I need to figure out the .js solution?
Update as of 9/29/15 @11:45am:
So, I am partway there with this! I embedded a button as the first column in each row of the table. When the button is clicked, I run a postProcess search and then use a table to display the results. Two remaining issues:
Here is the relevant XML code (please forgive any typos...I have to retype it here):
<module name="Search"> <param name="search"><![CDATA[ index=br | stats count as count sum(filesize) as Volume count(eval(priority=1)) as 1 count(eval(priority=2)) as 2 count(eval(priority=3)) as 3 by location, priority, direction, Hub, Host]]></param> <module name="PostProcess"> <param name="search"><![CDATA[ | stats sum(count) as "Total Files" sum(Volume) as Volume dc(Hub) as Hub dc(Host) as Host sum(1) as 1 sum(2) as 2 sum(3) as 3 by location, direction | eval Volume=round(Volume/1024/1024,2) | eval actions="PLACEHOLDER" | fields actions, location, direction, Hub, Host, "Total Files", 1, 2,3,Volume]]></param> <module name="Pager"> <module name="Table"> <module name="Button"> <param name="label">+</param> <param name="allowAutoSubmit">False</param> <module name="PostProcess"> <param name="search"><![CDATA[ | search $location$ | rename count as "Total Files"| eval Volume=round(Volume/1024/1024,2) | | fields location, direction, Hub, Host, "Total Files", 1, 2,3,Volume | sort Hub ]]></param> <module name="CustomBehavior"> <param name="requiresDispatch">True</param> </module> <module name="Table" /> </module> </module> </module> <module name="Pager" /> </module> </module
This is an example of what the initial table looks like:
Once the user clicks the + button the table should expand to look like this:
I'm afraid this is beyond what you can do with Table Embedding in the Sideview Table module.
What you need here, is expandable/collapsible functionality that makes use of the main table's columns and cells. And Table Embedding is restricted to rendering other modules within individual cells of the outer table. The closest you can come therefore, is having the outer table have only a single column, table-embed an HTML module that itself controls it's horizontal layout (ie it looks more or less tabular), and that has a Button or Link module in there that causes a push on an embedded table module. You could make the HTML module's horizontal layout line up somewhat with the embedded tables, and you could even copy the tabular styles exactly to really make it come close, but a certain jankiness would probably always remain.