Splunk Search

Extend table visualization with new properties to initialize table header with default sort order?

Graham_Hanningt
Builder

With apologies, I'll admit to being lazy asking this question. @niketnilay has already provided an answer to my similar recent question "Make table column header indicate the sort order of data in underlying search results?". I've accepted that answer because it works, but I can't bring myself to implement it in practice, because it doesn't meet my self-imposed standard of "elegance". Yes, I realize that beggars should not be choosers!

So I'm back with this new, more specific question.

As per that earlier question:

I want the sort indicators (up/down arrowheads) in table visualization column headings to reflect the default sort order of the data supplied by the underlying search.
I'm using the sort command in Splunk 7.3.0 to sort the search results for a table by one of the fields in descending order. So the rows of the table are already sorted. However, the sort indicators in the visualization don't reflect that default sort order.

Now, more specifically, for this question: what is the best way to extend the Splunk-supplied table visualization to include two new properties like this:

<option name="sortColumn">Column heading</option>
<option name="sortOrder">desc</option> <!-- Or asc -->

that (as per the answer by @niketnilay to my earlier question) set the up/down sort indicator in the corresponding column heading ( th )?

Is there any easy way to extend an existing visualization without duplicating all of its source code?

I understand that I should take the time myself to read the "Custom visualization" Splunk docs, locate the source code (if I can) for the supplied table viz, and work from there. But I don't currently have the luxury of that time. I'm hoping someone who is more familiar with this area will take pity on me and/or recognize the usefulness of what I'm asking for, and provide an answer.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...