topic Re: Timechart abridge values in Reporting

Timechart abridge values

nocostk — Fri, 28 Jan 2011 00:14:59 GMT

Is it possible to configure Splunk to NOT abridge the values in a timechart? For example, after a graph is displayed I'll hover over a point and get something like:

_time 2011-01-1...000-07:00
/opt/shop...cess_log 1832.024706841

I'd like to be able to see the complete values.

The same goes with the legend:

/opt/emailm...anager.log

Should be

/opt/emailmanager/logs/emailmanager.log

Re: Timechart abridge values

sophy — Fri, 28 Jan 2011 00:42:24 GMT

Hi!

So, if you look at the Custom charting configuration reference for "Tooltip properties", you'll see there are various "content" properties. For these properties, you can edit the textBlock format for charting, specifically the overflowMode.

Re: Timechart abridge values

nocostk — Fri, 28 Jan 2011 00:52:25 GMT

Great, that's it. I'm not seeing how to apply the changes on a global level, though. Specifically, when I do a search and click 'Show Report'.

Re: Timechart abridge values

gkanapathy — Fri, 28 Jan 2011 01:09:12 GMT

You can't (easily or supportably or upgradably) do it on a global level, I'm afraid. You'd have to set the properties on each chart in a view.