Splunk Search

Extend table visualization with new properties to initialize table header with default sort order?

Graham_Hanningt
Builder

With apologies, I'll admit to being lazy asking this question. @niketnilay has already provided an answer to my similar recent question "Make table column header indicate the sort order of data in underlying search results?". I've accepted that answer because it works, but I can't bring myself to implement it in practice, because it doesn't meet my self-imposed standard of "elegance". Yes, I realize that beggars should not be choosers!

So I'm back with this new, more specific question.

As per that earlier question:

I want the sort indicators (up/down arrowheads) in table visualization column headings to reflect the default sort order of the data supplied by the underlying search.
I'm using the sort command in Splunk 7.3.0 to sort the search results for a table by one of the fields in descending order. So the rows of the table are already sorted. However, the sort indicators in the visualization don't reflect that default sort order.

Now, more specifically, for this question: what is the best way to extend the Splunk-supplied table visualization to include two new properties like this:

<option name="sortColumn">Column heading</option>
<option name="sortOrder">desc</option> <!-- Or asc -->

that (as per the answer by @niketnilay to my earlier question) set the up/down sort indicator in the corresponding column heading ( th )?

Is there any easy way to extend an existing visualization without duplicating all of its source code?

I understand that I should take the time myself to read the "Custom visualization" Splunk docs, locate the source code (if I can) for the supplied table viz, and work from there. But I don't currently have the luxury of that time. I'm hoping someone who is more familiar with this area will take pity on me and/or recognize the usefulness of what I'm asking for, and provide an answer.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Classic British Rock Bands

This puzzle series (first published here) is based on extracting information from statements about well-known ...

New to the Community? Join Us for an Exclusive Post .conf26 Welcome Session (Plus a ...

Keep the .conf26 Energy Going: Welcome to the Splunk Community! Whether we scanned your badge at the Community ...

Accelerate Splunk App Development with AI

  Learn how to automate the repetitive parts of your build cycle.   Register to Attend   Join our Tech Talk ...