Splunk Search

How to truncate a string to fit in a table, but still be able to see the full string if clicked on?

johnraftery
Communicator

I have a table where sometimes the value of a field can be a very, very long string. I want this to be shown in a truncated form, but still have the option to see the full string somehow. Is this possible?

Many thanks,
John

0 Karma
1 Solution

dcarmack_splunk
Splunk Employee
Splunk Employee

Hi John

I assume you are working on a dashboard, so I suggest using the fieldformat or eval command to create a truncated version of the field

| eval truncated=replace(mylongfield,"^(.{5}).*",\1)."..."

This eval will create a condensed version of the field called truncated, which includes the first 5 characters followed by an ellipses.

Then you can use an in-page (contextual) drilldown that will populate a second panel with in the same dashboard with the full version of the text when the truncated version is clicked. The link below will show you how to do it in simple xml. If you are experienced with Javascript, you can convert the dashboard to html and do this as an info box on hover.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Understandbasictableandchartdrilldownactions#C...

View solution in original post

dcarmack_splunk
Splunk Employee
Splunk Employee

Hi John

I assume you are working on a dashboard, so I suggest using the fieldformat or eval command to create a truncated version of the field

| eval truncated=replace(mylongfield,"^(.{5}).*",\1)."..."

This eval will create a condensed version of the field called truncated, which includes the first 5 characters followed by an ellipses.

Then you can use an in-page (contextual) drilldown that will populate a second panel with in the same dashboard with the full version of the text when the truncated version is clicked. The link below will show you how to do it in simple xml. If you are experienced with Javascript, you can convert the dashboard to html and do this as an info box on hover.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Understandbasictableandchartdrilldownactions#C...

johnraftery
Communicator

Thanks very much!

0 Karma

woodcock
Esteemed Legend

That is pretty much what I said, too.

0 Karma

woodcock
Esteemed Legend

This is one of the use cases for fieldformat. It causes the field to maintain it's original value (so that drill down is not broken) but it has another value that you set whenever it is displayed.

0 Karma

johnraftery
Communicator

Thanks. I see that this would let you hide some of the text, but how do you allow the user to click to see the whole string?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...