Splunk Search

Extend table visualization with new properties to initialize table header with default sort order?

Graham_Hanningt
Builder

With apologies, I'll admit to being lazy asking this question. @niketnilay has already provided an answer to my similar recent question "Make table column header indicate the sort order of data in underlying search results?". I've accepted that answer because it works, but I can't bring myself to implement it in practice, because it doesn't meet my self-imposed standard of "elegance". Yes, I realize that beggars should not be choosers!

So I'm back with this new, more specific question.

As per that earlier question:

I want the sort indicators (up/down arrowheads) in table visualization column headings to reflect the default sort order of the data supplied by the underlying search.
I'm using the sort command in Splunk 7.3.0 to sort the search results for a table by one of the fields in descending order. So the rows of the table are already sorted. However, the sort indicators in the visualization don't reflect that default sort order.

Now, more specifically, for this question: what is the best way to extend the Splunk-supplied table visualization to include two new properties like this:

<option name="sortColumn">Column heading</option>
<option name="sortOrder">desc</option> <!-- Or asc -->

that (as per the answer by @niketnilay to my earlier question) set the up/down sort indicator in the corresponding column heading ( th )?

Is there any easy way to extend an existing visualization without duplicating all of its source code?

I understand that I should take the time myself to read the "Custom visualization" Splunk docs, locate the source code (if I can) for the supplied table viz, and work from there. But I don't currently have the luxury of that time. I'm hoping someone who is more familiar with this area will take pity on me and/or recognize the usefulness of what I'm asking for, and provide an answer.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...