topic Re: Disable or increase truncation of hostnames and timestamp in Security

Disable or increase truncation of hostnames and timestamp

JensT — Thu, 23 Sep 2010 04:46:16 GMT

Hello,

we have longer hostnames. Like "gateway_chvj500ld800.mycompany.net".

Its truncated to something like "gateway_chvj.....mycompany.net" So the important part is missing.

Same with Timestamps.

How can we eliminate the truncation?

Cheers,

Jens

Re: Disable or increase truncation of hostnames and timestamp

Mick — Thu, 23 Sep 2010 04:49:39 GMT

Are you talking about the actual field being truncated or is it just the way it is displayed in the UI, due to the available screen-space? Any chance to a screenshot?

Re: Disable or increase truncation of hostnames and timestamp

Genti — Thu, 23 Sep 2010 05:20:00 GMT

im sure it is in the UI, on the field picker little blue box.
JensT, if you mouse over one of the hosts, or timestamps, you should notice that the timestamp/host is fully there. If you click on one, it will add it correctly to the search query. The truncation is due to the available screen-space as mick points out, and im not sure if there can be done anything against it. I spoke to a UI a while back and seems that is the way it's supposed to be. JV might want to comment on this, if he sees this thread.

Re: Disable or increase truncation of hostnames and timestamp

Simeon — Thu, 23 Sep 2010 06:34:58 GMT

I don't believe there is an easy way to do it, but I might be wrong. I would create a rex and replace for your hostnames when running reports, similar to what is in this Question:

http://answers.splunk.com/questions/7077/how-can-i-rename-the-host-names-for-my-chart

Re: Disable or increase truncation of hostnames and timestamp

JensT — Thu, 23 Sep 2010 19:45:03 GMT

Here is a screenshot:

https://storage.driveonweb.de/dowdoc/f9f392e6c400d4fa09429d8da1ca8721.JPG