Splunk Search

width adjustable table

marendra
Explorer

Hi All

If I create table chart on the view, is tehre any way to adjust the width like a normal table?
The problem I have is I am email stats. When it comes to subject, long subject always a problem, since there is no such thing "wrapping" or width adjustment that I can do in Splunk table.
Help, please...

Thanks

Regards

Tags (1)
1 Solution

bwooden
Splunk Employee
Splunk Employee

You can place it last via the table command.

... | table sender, recipient, other_fields, subject

Or you can truncate the subject to a specific length. Below we truncate overall length to 20 (including "...")

... | eval subject=if(len(subject)>20,substr(subject,1,17)+"...",subject)

View solution in original post

TonyLeeVT
Builder

This was a pretty slick solution: https://answers.splunk.com/answers/84053/how-to-set-max-column-length.html. But it seemed to slow down presenting the results.

Snippet:
"Easiest was to make it a multivalued field.

 ... | rex field=longfield max_match=0 "(?<longfield>.{0,50})"

that'll split longfield into lines of no more that 50 characters."

Surender
Explorer

Thanks bwooden that works perfect.

Here is my sample for anybody else who is looking for more help.

source=general $env$ $tier$ $srctype$ $leveltok$ (exception=* OR message=* )

| eval level = if(isnotnull(level), level, "Not specified")

|stats count by exception message level sourcetype
| sort - count
| table exception message level sourcetype count
| eval exception=if(len(exception)>100,substr(exception,1,90)+"...",exception)
| eval message=if(len(message)>100,substr(message,1,90)+"...",message)
| eval earliest =$selection.earliest$

| eval latest=$selection.latest$

bwooden
Splunk Employee
Splunk Employee

You can place it last via the table command.

... | table sender, recipient, other_fields, subject

Or you can truncate the subject to a specific length. Below we truncate overall length to 20 (including "...")

... | eval subject=if(len(subject)>20,substr(subject,1,17)+"...",subject)

marendra
Explorer

Thanks it works. Is it correct for me saying that there is no way to adjust the column width by drag it like normal table? The only way to do it is pre-format it from the search it self?
What about the wrapping, if the text length is more than what has been defined, it will automatically appear below it?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...