Splunk Search

Extend table visualization with new properties to initialize table header with default sort order?

Graham_Hanningt
Builder

With apologies, I'll admit to being lazy asking this question. @niketnilay has already provided an answer to my similar recent question "Make table column header indicate the sort order of data in underlying search results?". I've accepted that answer because it works, but I can't bring myself to implement it in practice, because it doesn't meet my self-imposed standard of "elegance". Yes, I realize that beggars should not be choosers!

So I'm back with this new, more specific question.

As per that earlier question:

I want the sort indicators (up/down arrowheads) in table visualization column headings to reflect the default sort order of the data supplied by the underlying search.
I'm using the sort command in Splunk 7.3.0 to sort the search results for a table by one of the fields in descending order. So the rows of the table are already sorted. However, the sort indicators in the visualization don't reflect that default sort order.

Now, more specifically, for this question: what is the best way to extend the Splunk-supplied table visualization to include two new properties like this:

<option name="sortColumn">Column heading</option>
<option name="sortOrder">desc</option> <!-- Or asc -->

that (as per the answer by @niketnilay to my earlier question) set the up/down sort indicator in the corresponding column heading ( th )?

Is there any easy way to extend an existing visualization without duplicating all of its source code?

I understand that I should take the time myself to read the "Custom visualization" Splunk docs, locate the source code (if I can) for the supplied table viz, and work from there. But I don't currently have the luxury of that time. I'm hoping someone who is more familiar with this area will take pity on me and/or recognize the usefulness of what I'm asking for, and provide an answer.

Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...