Splunk Search

How to have same table behavior in dashboard as ad-hoc.


Is there a way to get the full featured table that shows up under the "Statistics" tab for ad-hoc queries on a dashboard??

Specifically I want the stats, paging and columns to stick to the top of the screen when scrolling vertically and the horizontal scrollbar to be always visible.

Run anywhere example:
| eval reallyLongFormattedTimeColumnName = strftime(_time, "%c")
| eval reallyLongColumnNameForLowerHostToCauseHorizontalScrolling = lower(host)
| eval reallyLongColumnNameForLowerRawJustInCaseYouHaveABigMonitor = lower(_raw)
| table _time, reallyLongFormattedTimeColumnName, host, reallyLongColumnNameForLowerHostToCauseHorizontalScrolling, _raw, reallyLongColumnNameForLowerRawJustInCaseYouHaveABigMonitor

When running this in an ad-hoc search I get a cool section above the column names that has some paging and formatting tools. Those go away when this code is ran in a dashboard.

Also, the ad-hoc search keeps the toolbar and column headers at the top of the scrolling area as well as the horizontal scrollbar on the bottom.

These features are really nice, so would love to use them on my dashboard. Thanks.

Running in Splunk Cloud so using fancy pants CSS and JS is possible but not desirable as we have to go through vetting to get those types of changes uploaded. Keeping things as Simple Xml would be ideal.

0 Karma


Found the top tools container, it toggles a class called "affix-top" when scrolling vertically:

Normal: <div class="statistics-controls-inner">
Scrolled: <div class="statistics-controls-inner affix-top">

Also found the column header, looks like a copy of the header is toggled when scrolling because the visibility goes from hidden to block:

Normal: <div class="header-table-docked" style="right: 0px; left: 0px; display: none; top: -1000px;">
Scrolled: <div class="header-table-docked" style="right: 0px; left: 0px; display: block; top: 36px;">

But no idea how to get these added to my dashboard. 😞

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...