topic Re: Splunk 8.0.1 : How to change show_source CSS about long lines in Splunk Search

Splunk 8.0.1 : How to change show_source CSS about long lines

mpasini — Mon, 09 Aug 2021 11:51:23 GMT

Hello,

After upgrading to Splunk 8 from Splunk 6, it seems that the "show_source" view ( used in "Event actions" -> "Show source" ) isn't wrapping the long lines as it used to do before.

We've isolated the new setting in jsx code in:

/opt/splunk/share/splunk/search_mrsparkle/exposed/js/views/show_source/index.jsx

tableRow: { border: 0, margin: 0, padding: 0, whiteSpace: 'nowrap', },

Before the setting was set to 'white-space: pre-wrap' as we can see in our backups of search_mrsparkle from splunk6.

Is there any way for us to go the same behavior as before so that the long lines in "Show source" are wrapped ?

Re: Splunk 8.0.1 : How to change show_source CSS about long lines

richgalloway — Mon, 09 Aug 2021 12:00:05 GMT

If seems like you've already found the answer - change index.jsx as you prefer. However, it's possible that fix is already present in one of the 18 Splunk versions released since 8.0.1 so you may want to consider a newer release. You also can ask for the change at https://ideas.splunk.com

Re: Splunk 8.0.1 : How to change show_source CSS about long lines

mpasini — Mon, 09 Aug 2021 15:04:09 GMT

Actually, I found that the "wrapping" option was lost until the version 8.0.4 when the "Wrap Results" button was added:

So I guess we'll upgrade 🙂