Splunk Search

Prevent users from table sorting (when clicking on its headers)

kikexclusive
Path Finder

The question is really simple, not that sure about the answer though. I'm using Splunk 5.0.6 + Advanced XML panels to render my results in a Table. I would like to know if it's possible to disable the default option of sorting the table when the user clicks on one of the table header fields.

In other words, I don't want the user to be able to modify the way the table has been rendered after the webpage loads.

Cheers!

jadengoho
Builder

You can do this using CSS

 <panel depends="$hide$">
      <html>
        <style>
i.icon-sorts {display: none;}
th { pointer-events: none;}
        </style>
      </html>
    </panel>

sideview
SplunkTrust
SplunkTrust

Note - this answer is only relevant for the simple XML and is not relevant at all to the Advanced XML or the Sideview XML.

And this question is explicitly about how to do this in the Sideview XML.

0 Karma

jadengoho
Builder

okay - other users can use this though on Simple XML

0 Karma

sideview
SplunkTrust
SplunkTrust

There's no way to do this currently in the Sideview Table module. However it's an easy feature to add and you're the second or third customer to ask for it, so it has been added. It will go out in the next release which should be in a week or two.

How it works is there will be a new optional param called "allowSorting". 99% of the time you will leave it blank and you'll get the current behavior with the clickable column headers and arrows etc. If you set <param>False, then the column headers will not be clickable and wont have little arrows.

If you really need a short term hack and you're somewhat comfortable in Javascript and able to edit application.js, you could explore using a customBehavior param on the Table, and defining in your customBehavior that the "onSortClick" method should do nothing at all.

sideview
SplunkTrust
SplunkTrust

Just to confirm - this feature did go out, just as described above, in Sideview Utils 3.3.3. If you can't find it, just upgrade. Release notes are here - http://sideviewapps.com/apps/sideview-utils/release-notes/

And if you go to Manage Apps and you're confused because Splunk tells you have 1.3.5 and 1.3.5 is the most recent version, that's because you can only get Sideview Utils from the sideview website. Latest is 3.3.6 and you can download for free by clicking the "download full version" link on the following page: http://sideviewapps.com/apps/sideview-utils/

0 Karma

kikexclusive
Path Finder

Thanks a lot for letting me know ! Your help is always very useful

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...