Splunk Search

Search results are not wrapping, can't scroll right.

horngary
Engager

I have searched for some traps. The results are not wrapping and I can't scroll any further right. The only way I can view the whole trap is to export it.

I have played with the Options/Display Search Results settings without success.

I am using IE7.

Can anyone help?

cpenkert
Path Finder

Nick - if you are able to post an example, that would be very helpful. This has been a nagging issue I'd like to clean up.

jaxjohnny2000
Builder

Here is an example, i have the same nagging issue.
This is a Windows security event when someone added a user to a domain group. I am looking to find out who made the change to an account, and which group they added them to. So i have some code to pull out the user information.

index=windows_security_eventlog sourcetype="WinEventLog:Security" (EventCode=4728)
| rex mode=sed field=Message "s/[\r\t]+/ /g"
| eval event_time = strftime(_time, "%Y-%m-%d %H:%M:%S %Z")
| eval changed_by=mvindex(Account_Name,0)
| eval modified_account=mvindex(Account_Name,1)
| table event_id event_time EventCode EventCodeDescription changed_by src_user modified_account user msad_action Group_Name Message
| sort 0 - event_time

0 Karma

sideview
SplunkTrust
SplunkTrust

My guess is that there are no spaces in the events? The word wrap setting in the little "Options" popup (which is itself a bit hard to discover) -- that setting will only do anything if/when there are spaces in the events. It wont even break at commas or semicolons, hyphens etc. Although I believe the 3.X version used to.

You could customize it by tweaking the CSS in your app a bit. The core CSS involved is in EventsViewer.css which you dont want to edit. However you can override the relevant pieces by putting rules into /etc/apps/<appname>/appserver/static/application.css.

If this sounds useful I could paste in an example.

Glenn
Builder

This does sound useful, could you paste an example? This happens a lot in our environment and I get users complaining about Splunk's usability because of it. If I can tweak it out of existence that would be nice.

gkanapathy
Splunk Employee
Splunk Employee

The horizontal scroll bar is all the way at the bottom of the window inside the main frame. You'll need to scroll all the way to the bottom of the page to see it.

horngary
Engager

OK, that's somewhat helpful. But why aren't the results wrapping? Have any ideas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...