Splunk Search

Extend table visualization with new properties to initialize table header with default sort order?

Graham_Hanningt
Builder

With apologies, I'll admit to being lazy asking this question. @niketnilay has already provided an answer to my similar recent question "Make table column header indicate the sort order of data in underlying search results?". I've accepted that answer because it works, but I can't bring myself to implement it in practice, because it doesn't meet my self-imposed standard of "elegance". Yes, I realize that beggars should not be choosers!

So I'm back with this new, more specific question.

As per that earlier question:

I want the sort indicators (up/down arrowheads) in table visualization column headings to reflect the default sort order of the data supplied by the underlying search.
I'm using the sort command in Splunk 7.3.0 to sort the search results for a table by one of the fields in descending order. So the rows of the table are already sorted. However, the sort indicators in the visualization don't reflect that default sort order.

Now, more specifically, for this question: what is the best way to extend the Splunk-supplied table visualization to include two new properties like this:

<option name="sortColumn">Column heading</option>
<option name="sortOrder">desc</option> <!-- Or asc -->

that (as per the answer by @niketnilay to my earlier question) set the up/down sort indicator in the corresponding column heading ( th )?

Is there any easy way to extend an existing visualization without duplicating all of its source code?

I understand that I should take the time myself to read the "Custom visualization" Splunk docs, locate the source code (if I can) for the supplied table viz, and work from there. But I don't currently have the luxury of that time. I'm hoping someone who is more familiar with this area will take pity on me and/or recognize the usefulness of what I'm asking for, and provide an answer.

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...