[Security Solution][Bug]Index pattern is not updating for trends and session table as per selected Data view on Hosts page.

[chetnarajput-qasource]

Describe the bug:
User has selected different data view from the Data View Picker on Hosts page and on clicking inspect icon of Trend/ Graphs the inspect pop-up opens up and user is seeing old index pattern. The index pattern for session table is also not updated as per selected data view.

Kibana/Elasticsearch Stack version:

VERSION: 9.2.0
BUILD: 89623
COMMIT: 7b216a97c1154cac2ccce0da0097784c0d6700ad

Browser and Browser OS versions:
Google Chrome Version 139.0.7258.128 (Official Build) (64-bit)

Steps to reproduce:
1.Kibana 9.2.0 Snapshot must be running.
2.The Data View Picker feature should be enabled.
3.Beats should be installed and alerts should be triggered.
4.Navigate to Explore > Hosts, default Data view displayed in the Data View Picker.
5.Click on the Data View picker and Select another data view, say packetbeat.
6.Click on the Inspect icon of any graph (Hosts, Source, Destination), the inspect pop-up opens up.
7.Observe the index pattern of graph (Hosts, Source, Destination) is not updated as selected Data view.
8.Switch to Session tab and click on inspect icon of session table.
9.Observe Index pattern of session table is not updated as per selected data view.

Current behavior:
Index pattern is not updating for Graphs/ trends (Hosts, Source, Destination) and session table as per selected Data view on Hosts page.

Expected behavior:
The updated index pattern as per selected Data view should display on the inspect pop-up of Graphs/ trend and Session table.

Screenshots/ screen recording:

Issue-on.inspect.Index.pattern.not.updating.as.per.selected.data.view.mp4

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[chetnarajput-qasource]

Suggestions:
Model used:
GPT-4.1

Steps to Fix

1. Identify the Data View Picker Implementation on Hosts Page

• File likely involved:
  • x-pack/plugins/security_solution/public/explore/hosts/hosts_page/index.tsx
  • x-pack/plugins/security_solution/public/explore/hosts/components/data_view_picker.tsx
  • Or wherever the Data View Picker is implemented.

2. Track Where the Data View is Passed

• Look for where the selected Data View is stored (probably in state or context).
• Ensure that the selected Data View is passed down to the graph and session table components as a prop.

3. Update Graph and Table Components

• Files likely involved:

  • x-pack/plugins/security_solution/public/explore/hosts/components/hosts_trend_graph.tsx
  • x-pack/plugins/security_solution/public/explore/hosts/components/session_table.tsx
  • Look for inspect logic in these files or their child components.

• What to change:

  • Make sure these components use the current Data View (index pattern) from props/context for both data fetching and Inspect pop-up rendering.

4. Update Inspect Logic

• Files likely involved:

  • x-pack/plugins/security_solution/public/common/components/inspect

• What to change:

  • When showing the inspect pop-up, ensure it references the current Data View, not a cached or default one.

[chetnarajput-qasource]

@muskangulati-qasource Please review.
Thanks!

[muskangulati-qasource]

Reviewed and assigned to @michaelolo24

[elasticmachine]

Pinging @elastic/security-threat-hunting-investigations (Team:Threat Hunting:Investigations)