It's perfect now  😃 Thank you @kamlesh_vaghela  ... View more

Yes, I did that to get rid of the query and key column from the parent table. But, there is bug which I mentioned with the screenshot. Did you get a chance to see my screenshot? When I flip back to the same row which I opened earlier this error pops out.   ... View more

Thanks @kamlesh_vaghela, I did find a solution to get rid of the key column, I replaced the key with the process in the JS.  Since, process column is required in the parent table now process will act as a click event and make the row expansion work as I expected.  I found a bug. When I try to expand the row in a sequence it works fine but when I try to expand the row which I already expanded once then I am getting error. For example, I have 3 rows 1,2 and 3. If I click on 1 then 2 then 3 and again if I click on 1 it throws below error. The loop doesn't work.   ... View more

Thanks @kamlesh_vaghela, I could find there was an issue with the search I corrected it and the could see the value in the expanded row. But, I have one more issue like the "query" column is getting populated in the parent table. If I try to hide using the fields option or css then "query" column won't be available for the JS to do the row expand. Is there any way to hide the "query" column from the parent table and make the row expansion work?   ... View more

Hi @kamlesh_vaghela, I changed the search like below in your JS and tried. It didn't work. Still the row expand shows "No result found" //update the search with the sourcetype that we are interested in this._searchManager.set({ search: 'query="' + processCell.value + '" ' });  Thanks, ... View more

Hi @kamlesh_vaghela, I created a new question https://community.splunk.com/t5/Developing-for-Splunk-Enterprise/Table-row-expansion-with-dynamic-search-in-the-JS/td-p/561377 Thanks 🙂   ... View more

Hi @kamlesh_vaghela, Thank you for acknowledging my question. Below is the JS which I have for table row expansion which works fine for my requirement. I want the search given in the JS should be passed from my Splunk dashboard instead of hardcoding it here. This is because I don't to update the JS whenever I want to add or delete anything in my search.  Below search in JS which I want to be passed through Splunk dynamically instead of hardcoding in JS: this._searchManager.set({ search: 'index=idx_omn source=vs.csv | eval key=process+" "+oprocess_start_date | search key="' + processCell.value + '" | stats values(process) as process values(oprocess_start_date) as oprocess_start_date values(oprocess_end_date) as oprocess_end_date values(otrans) as otrans values(otpm) as otpm values(oelapsed_mins) as oelapsed_mins values(total_count) as total_count values(local_currency) as local_currency values(local_swift) as local_swift values(local_amt) as local_amt values(eur_local) as eur_local BY file_number_list| table process,oprocess_start_date,oprocess_end_date,file_number_list,otrans,otpm,oelapsed_mins,total_count,local_currency,local_swift,local_amt,eur_local '}); XML:   <dashboard script="custom_table_row_expansion1.js"> <label>Visa row expansion</label> <row> <panel> <table id="expand_with_events"> <search> <query>index="idx_omn" source="vs.csv" | eval key=process+" "+oprocess_start_date | stats values(process) as process values(oprocess_start_date) as oprocess_start_date values(oprocess_end_date) as oprocess_end_date values(otrans) as otrans values(otpm) as otpm values(oelapsed_mins) as oelapsed_mins sum(total_count) as total_count values(local_currency) as local_currency values(local_swift) as local_swift sum(local_amt) as local_amt sum(eur_local) as eur_local BY key | table process oprocess_start_date oprocess_end_date otrans otpm oelapsed_mins total_count local_currency local_swift local_amt eur_local key</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>   JS:   require([ 'splunkjs/mvc/tableview', 'splunkjs/mvc/chartview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'underscore', 'splunkjs/mvc/simplexml/ready!'],function( TableView, ChartView, SearchManager, mvc, _ ){ var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({ initialize: function(args) { // initialize will run once, so we will set up a search and a chart to be reused. this._searchManager = new SearchManager({ id: 'details-search-manager', preview: false }); //this._chartView = new ChartView({ // managerid: 'details-search-manager', // 'charting.legend.placement': 'none' //}); this._TableView = new TableView({ id: 'TestTable', managerid: 'details-search-manager', drilldown: 'cell' }); }, canRender: function(rowData) { // Since more than one row expansion renderer can be registered we let each decide if they can handle that // data // Here we will always handle it. return true; }, render: function($container, rowData) { // rowData contains information about the row that is expanded. We can see the cells, fields, and values // We will find the key(process and start date) cell to use its value var processCell = _(rowData.cells).find(function (cell) { return cell.field === 'key'; }); //update the search with the key that we are interested in this._searchManager.set({ search: 'index=idx_omn source=vs.csv | eval key=process+" "+oprocess_start_date | search key="' + processCell.value + '" | stats values(process) as process values(oprocess_start_date) as oprocess_start_date values(oprocess_end_date) as oprocess_end_date values(otrans) as otrans values(otpm) as otpm values(oelapsed_mins) as oelapsed_mins values(total_count) as total_count values(local_currency) as local_currency values(local_swift) as local_swift values(local_amt) as local_amt values(eur_local) as eur_local BY file_number_list| table process,oprocess_start_date,oprocess_end_date,file_number_list,otrans,otpm,oelapsed_mins,total_count,local_currency,local_swift,local_amt,eur_local '}); // $container is the jquery object where we can put out content. // In this case we will render our chart and add it to the $container //$container.append(this._chartView.render().el); $container.append(this._TableView.render().el); } }); var tableElement = mvc.Components.getInstance("expand_with_events"); tableElement.getVisualization(function(tableView) { // Add custom cell renderer, the table will re-render automatically. tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer()); }); });     I did try by creating a field called "query" which has the query for the row expansion and passed it to the below JS but it didn't return any result. Please ignore this approach if there is any better solution available. XML for passing the entire query to column called query:   <dashboard script="custom_table_row_expansion2.js"> <label>Visa row expansion Clone</label> <row> <panel> <table id="expand_with_events"> <search> <query>index="idx_omn" source="vs.csv" | eval key=process+" "+oprocess_start_date | eval query1 = "idx_omn source=\"visabase.csv\" | search key =\"" | eval query2 = "\"| stats values(process) as process values(oprocess_start_date) as oprocess_start_date values(oprocess_end_date) as oprocess_end_date values(otrans) as otrans values(otpm) as otpm values(oelapsed_mins) as oelapsed_mins values(total_count) as total_count values(local_currency) as local_currency values(local_swift) as local_swift values(local_amt) as local_amt values(eur_local) as eur_local BY file_number_list" | eval query = query1+key+query2 | stats values(process) as process values(oprocess_start_date) as oprocess_start_date values(oprocess_end_date) as oprocess_end_date values(otrans) as otrans values(otpm) as otpm values(oelapsed_mins) as oelapsed_mins sum(total_count) as total_count values(local_currency) as local_currency values(local_swift) as local_swift sum(local_amt) as local_amt sum(eur_local) as eur_local values(query) as query BY key | table process oprocess_start_date oprocess_end_date otrans otpm oelapsed_mins total_count local_currency local_swift local_amt eur_local key query</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>     JS for the new try which didn't redturn any result:   require([ 'splunkjs/mvc/tableview', 'splunkjs/mvc/chartview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'underscore', 'splunkjs/mvc/simplexml/ready!'],function( TableView, ChartView, SearchManager, mvc, _ ){ var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({ initialize: function(args) { // initialize will run once, so we will set up a search and a chart to be reused. this._searchManager = new SearchManager({ id: 'details-search-manager', preview: false }); //this._chartView = new ChartView({ // managerid: 'details-search-manager', // 'charting.legend.placement': 'none' //}); this._TableView = new TableView({ id: 'TestTable', managerid: 'details-search-manager', drilldown: 'cell' }); }, canRender: function(rowData) { // Since more than one row expansion renderer can be registered we let each decide if they can handle that // data // Here we will always handle it. return true; }, render: function($container, rowData) { // rowData contains information about the row that is expanded. We can see the cells, fields, and values // We will find the sourcetype cell to use its value var processCell = _(rowData.cells).find(function (cell) { return cell.field === 'query'; }); //update the search with the sourcetype that we are interested in this._searchManager.set({ search: 'index= "' + processCell.value + '" '}); // $container is the jquery object where we can put out content. // In this case we will render our chart and add it to the $container //$container.append(this._chartView.render().el); $container.append(this._TableView.render().el); } }); var tableElement = mvc.Components.getInstance("expand_with_events"); tableElement.getVisualization(function(tableView) { // Add custom cell renderer, the table will re-render automatically. tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer()); }); });       ... View more

Hi @vnravikumar  I would like to know whether we can pass the entire splunk search dynamically which is used in JS for row expansion? Instead of hardcoding the search is there a way to pass the entire search dynamically to the javascript. The problem I am facing is, i need to keep on updating the search in the JS whenever I want to add a column. So if I could pass the entire search dynamically from Splunk to the JS and the JS helps in row expansion. Thanks,   ... View more

Hi @kamlesh_vaghela, Can this tooltip changes be applied to heatmap tooltip? I have only xaxis and yaxis value in the heatmap tooltip when I hover the heatmap blocks like below. Is it possible to add more fields to this tooltip? I have extra fields values that needs to populated like minutes, process name etc. Could you please advice on the same? I have posted a question please refer this  https://community.splunk.com/t5/Dashboards-Visualizations/How-to-display-more-values-in-heatmap-tooltip/m-p/544059#M37312 Thanks in advance! ... View more

@sylim_splunk currently i am facing role related issue in ITSI. I installed ITSI 4.3.1 version in Splunk enterprise 8.0.3 and after successful installation when I open the ITSI app the below error pops out saying "Could not load page settings. Check that you have the proper roles and permissions. Details: Page not found!" and when I try to open other options like glass tables, deep dive etc. it throws another error saying "Deep Dive could not be loaded. Possible cause: connection lost. Try restarting the Splunk platform. Status: 404 (Not Found) Details: Page not found!" Below is my authorise list for role_admin which looks ok but not sure why the above errors occur. Could you please help with your expertise. I have attached the screenshot as well. C:\Program Files\Splunk\bin>splunk btool authorize list role_admin [role_admin] accelerate_datamodel = enabled admin_all_objects = enabled apps_backup = enabled apps_restore = enabled change_authentication = enabled cumulativeRTSrchJobsQuota = 400 cumulativeSrchJobsQuota = 200 dispatch_rest_to_indexers = disabled edit_authentication_extensions = enabled edit_bookmarks_mc = enabled edit_cmd = enabled edit_deployment_client = enabled edit_deployment_server = enabled edit_dist_peer = enabled edit_encryption_key_provider = enabled edit_forwarders = enabled edit_health = enabled edit_httpauths = enabled edit_indexer_cluster = enabled edit_indexerdiscovery = enabled edit_input_defaults = enabled edit_local_apps = enabled edit_metric_schema = enabled edit_metrics_rollup = enabled edit_modinput_admon = enabled edit_modinput_perfmon = enabled edit_modinput_winhostmon = enabled edit_modinput_winnetmon = enabled edit_modinput_winprintmon = enabled edit_monitor = enabled edit_restmap = enabled edit_roles = enabled edit_scripted = enabled edit_search_concurrency_all = enabled edit_search_head_clustering = enabled edit_search_schedule_priority = enabled edit_search_scheduler = enabled edit_search_server = enabled edit_server = enabled edit_server_crl = enabled edit_splunktcp = enabled edit_splunktcp_ssl = enabled edit_splunktcp_token = enabled edit_tcp = enabled edit_tcp_stream = enabled edit_telemetry_settings = enabled edit_token_http = disabled edit_tokens_all = enabled edit_tokens_own = enabled edit_tokens_settings = enabled edit_udp = enabled edit_upload_and_index = enabled edit_user = enabled edit_view_html = enabled edit_web_settings = enabled edit_win_eventlogs = enabled edit_win_regmon = enabled edit_win_wmiconf = enabled edit_workload_pools = enabled edit_workload_rules = enabled get_diag = enabled grantableRoles = admin importRoles = itoa_admin;itoa_analyst;itoa_user;power;user indexes_edit = enabled install_apps = enabled license_edit = enabled license_tab = enabled license_view_warnings = enabled list_cascading_plans = enabled list_deployment_client = enabled list_deployment_server = enabled list_dist_peer = enabled list_forwarders = enabled list_health = enabled list_httpauths = enabled list_indexer_cluster = enabled list_indexerdiscovery = enabled list_pdfserver = enabled list_pipeline_sets = enabled list_search_head_clustering = disabled list_search_scheduler = enabled list_settings = disabled list_storage_passwords = disabled list_tokens_all = enabled list_win_localavailablelogs = enabled list_workload_pools = enabled list_workload_rules = enabled never_expire = enabled never_lockout = enabled read_metric_ad = disabled refresh_application_licenses = enabled rest_apps_management = enabled restart_reason = enabled restart_splunkd = enabled rtSrchJobsQuota = 100 run_collect = enabled run_debug_commands = enabled run_mcollect = enabled run_msearch = enabled schedule_rtsearch = enabled select_workload_pools = enabled srchDiskQuota = 25000 srchFilter = * srchFilterSelecting = true srchIndexesAllowed = *;_*;itsi_grouped_alerts;itsi_notable_archive;itsi_notable_audit;itsi_summary;itsi_tracked_alerts srchIndexesDefault = main srchJobsQuota = 50 srchMaxTime = 8640000 srchTimeWin = 0 web_debug = enabled write_metric_ad = disabled write_pdfserver = enabled ... View more

It won't work as the query is not picking the maximum count of each second(Transaction per second for each host), it does the overall count and the _time is not considered in the initial stats so the _time is not considered anywhere down the line ... View more