All Apps and Add-ons

How to create a table in Sideview Utils where the rows expand to show more data?

lyndac
Contributor

I want to do something similar to the "Table where rows expand to show more information" in the Splunk 6 Examples App, but I want to do it with sideview Table. I can't find anything that references that functionality in Sideview

Is it possible, or do I need to figure out the .js solution?

Update as of 9/29/15 @11:45am:

So, I am partway there with this! I embedded a button as the first column in each row of the table. When the button is clicked, I run a postProcess search and then use a table to display the results. Two remaining issues:

  1. I'd like the embedded results table to span the entire width of the original (containing) table (it is confined to the column that contained the embedded button).
  2. I'd like to be able to hide the embedded table when the user clicks the button again. Ideally, I'd like to switch the label of the button on each click as well.

Here is the relevant XML code (please forgive any typos...I have to retype it here):

<module name="Search">
  <param name="search"><![CDATA[ index=br | stats count as count sum(filesize) as Volume count(eval(priority=1)) as 1 count(eval(priority=2)) as 2 count(eval(priority=3)) as 3 by location, priority, direction, Hub, Host]]></param>
  <module name="PostProcess">
    <param name="search"><![CDATA[ | stats sum(count) as "Total Files" sum(Volume) as Volume dc(Hub) as Hub dc(Host) as Host sum(1) as 1 sum(2) as 2 sum(3) as 3  by location, direction | eval Volume=round(Volume/1024/1024,2) | eval actions="PLACEHOLDER" | fields actions, location, direction, Hub, Host, "Total Files", 1, 2,3,Volume]]></param>
    <module name="Pager">
      <module name="Table">
        <module name="Button">
          <param name="label">+</param>
          <param name="allowAutoSubmit">False</param>
          <module name="PostProcess">
            <param name="search"><![CDATA[ | search $location$ | rename count as "Total Files"| eval Volume=round(Volume/1024/1024,2) | | fields  location, direction, Hub, Host, "Total Files", 1, 2,3,Volume | sort Hub ]]></param>
            <module name="CustomBehavior">
              <param name="requiresDispatch">True</param>
            </module>
            <module name="Table" />
          </module>
        </module>
      </module>
    <module name="Pager" />
  </module>
</module

This is an example of what the initial table looks like:
alt text

Once the user clicks the + button the table should expand to look like this:
alt text

sideview
SplunkTrust
SplunkTrust

I'm afraid this is beyond what you can do with Table Embedding in the Sideview Table module.
What you need here, is expandable/collapsible functionality that makes use of the main table's columns and cells. And Table Embedding is restricted to rendering other modules within individual cells of the outer table. The closest you can come therefore, is having the outer table have only a single column, table-embed an HTML module that itself controls it's horizontal layout (ie it looks more or less tabular), and that has a Button or Link module in there that causes a push on an embedded table module. You could make the HTML module's horizontal layout line up somewhat with the embedded tables, and you could even copy the tabular styles exactly to really make it come close, but a certain jankiness would probably always remain.

An entirely different option... that involves a little javascript, would be to have the detail rows present in the underlying job, but use postprocess to hide them all. Then when the user clicks some table-embedded control like a link or a button, have custom JS call getResults on the main Table, but pass arguments such that that summary-row's "detail rows" actually do get rendered. This would probably be a little wonky with respect to the Pager's paging but it's an interesting option that springs to mind and might well be only a few lines of JS. email me if you want to go that way and I can provide a pointer or two.

0 Karma

lyndac
Contributor

@sideview : I'd like to try the javascript option that you talk about in the second paragraph, but don'w know your email...

0 Karma

sideview
SplunkTrust
SplunkTrust

Sure. It's just nick [at] sideviewapps.com

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...