This is an example from the Splunk dashboard examples app - (Custom Table Row Expansion) - which shows lazy search string evaluation. https://splunkbase.splunk.com/app/1603 requirejs([
'../app/simple_xml_examples/libs/underscore-1.6.0-umd-min',
'splunkjs/mvc/tableview',
'splunkjs/mvc/chartview',
'splunkjs/mvc/searchmanager',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
], function(_, TableView, ChartView, SearchManager, mvc) {
var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({
initialize: function() {
// initialize will run once, so we will set up a search and a chart to be reused.
this._searchManager = new SearchManager({
id: 'details-search-manager',
preview: false
});
this._chartView = new ChartView({
'managerid': 'details-search-manager',
'charting.legend.placement': 'none'
});
},
canRender: function(rowData) {
// Since more than one row expansion renderer can be registered we let each decide if they can handle that
// data
// Here we will always handle it.
return true;
},
render: function($container, rowData) {
// rowData contains information about the row that is expanded. We can see the cells, fields, and values
// We will find the sourcetype cell to use its value
var sourcetypeCell = _(rowData.cells).find(function (cell) {
return cell.field === 'sourcetype';
});
//update the search with the sourcetype that we are interested in
this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count' });
// $container is the jquery object where we can put out content.
// In this case we will render our chart and add it to the $container
$container.append(this._chartView.render().el);
}
});
var tableElement = mvc.Components.getInstance('expand_with_events');
tableElement.getVisualization(function(tableView) {
// Add custom cell renderer, the table will re-render automatically.
tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer());
});
});
... View more
