Dashboards & Visualizations

SimpleResultsTable - Can it wrap a field

Michael_Wilde
Splunk Employee
Splunk Employee

Is there a way to make SimpleResultsTable wrap a field. (field has a very long event message in it, and i'd like to shrink the size of the module width, but not have a right/left scrollbar), rather i'd like to wrap if possible.

Thoughts?

Tags (2)

ftk
Motivator

Depending on what data you display, a second option would be to install the Sideview Utils app, and forego the SimpleResultsTable all together -- use Sideview's HTML module instead. You won't have to mess with the CSS at that point plus you can really control the layout. For a drill down that would show a very large text string (a huge regex) I actually used the HTML module along with <textarea> tags.

So you could do something like this (table is optional, I just like things to line up):

<module name="HTML">
<param name="html"><![CDATA[
        <table border=0>
        <tr><td align=right>Customer:</td><td>$selectedCustomer$</td></tr>
        <tr><td align=right>Some ID:</td><td>$click.fields.someid$</td></tr>
        <tr><td align=right valign=top>String:</td><td><textarea rows="4" cols="200">$results[0].string$</textarea></td></tr>
        <tr><td align=right valign=top>otherstring:</td><td><textarea rows="2" cols="200">$results[0].otherstring$</textarea></td></tr>
        </table>
        ]]></param>
</module>

Make sure you read up on how to use the HTML module in Sideview Utils first, and have a look at the example views included in that app.

gkanapathy
Splunk Employee
Splunk Employee

Looking in $SPLUNK_HOME/etc/share/splunk/search_mrsparkle/modules/results/SimpleResultsTable.css, it seems that

.SimpleResultsTable table.simpleResultsTable {
    white-space:nowrap;
}

so you'll probably have to override it to normal at the view level with a CSS file you include in the view XML. (Don't know if you can specify a custom one in Simple XML. If not, and you're using that, then you'll have to override it app-wide in application.css I think.) To be more specific and just do it for one table, I don't know. Sadly, there's no way to push down attributes from modules (e.g., a name or id or class or style) on a visible HTML element as far as I know. You could, I guess, use the cheap and fragile way of finding the object id in a particular view's code and then create a class that applies just to that object. Ugh. By row or column? Make friends with the CSS inspector.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...