topic Re: Splunk doesn't display extra spaces in Splunk Search

Splunk doesn't display extra spaces

LearningGuy — Wed, 06 Nov 2024 20:05:57 GMT

Hello,
Splunk doesn't display extra spaces on variables that I assigned. Please see below example
I used Google Chrome and Microsoft Edge, it gave me same results. If I exported the CSV, the data have correct number of spaces.
Please suggest. Thank you

Re: Splunk doesn't display extra spaces

Jawahir — Wed, 06 Nov 2024 20:13:29 GMT

Hi, it should work, and it’s working fine on my end. Try upgrading your browser if you have any pending updates.

------

If you find this solution helpful, please consider accepting it and awarding karma points !!

Re: Splunk doesn't display extra spaces

LearningGuy — Wed, 06 Nov 2024 21:43:05 GMT

@Jawahir
I don't have any pending updates.
If it's a browser issue, then why is it displaying text correctly in the search box, but not on the statistical table in Splunk?
Thanks

Re: Splunk doesn't display extra spaces

yuanliu — Thu, 07 Nov 2024 04:52:09 GMT

Like @Jawahir , I cannot reproduce your results.

My instance is 9.3.1. Whether this is a update issue, Splunk itself does output the correct spacing in the stats table in my browsers, namely Safari 17.6, Chrome 129.0.6668.60, and Firefox 94.0.1.

In short, Splunk does display extra spaces. Something in your browser's renderer is giving the incorrect display.

Re: Splunk doesn't display extra spaces

LearningGuy — Thu, 07 Nov 2024 05:16:59 GMT

Hi @yuanliu

Could it be an issue with my Splunk profile?
I am using Splunk Enterprise Version:9.0.4. My browser is Google Chrome Version 130.0.6723.117 (Official Build) (64-bit) and Microsoft Edge Version 130.0.2849.68 (Official build) (64-bit)

If it's a browser issue, why is it not working on another browser like Microsoft Edge?

Thank you for your help

Re: Splunk doesn't display extra spaces

PickleRick — Thu, 07 Nov 2024 08:20:01 GMT

That is an interesting issue and it's definitely a browser issue.

If I run your search I see the results with proper spacing differences.

But.

If I go into page source in developer tools I get this:

They look evenly spaced, right? But they aren't. If I double click on those values to edit them, they "spread" (I think something changes font-wise when you're editing the contents).

So it's definitely something with text rendering on the browser's side.

Re: Splunk doesn't display extra spaces

LearningGuy — Thu, 07 Nov 2024 15:16:03 GMT

Hi @PickleRick

Thank you for your response.
I checked the developer tools, and it did show extra spaces on the browser.
The PC support asked me this question "if this is a browser issue, then why did the issue also occur on a different browser? So, no chance it's a Splunk profile issue?
I already cleared, my cache and it's the same issue.
The next step is that I will test it using a different PC used by Splunk user that doesn't have this issue

Re: Splunk doesn't display extra spaces

LearningGuy — Thu, 07 Nov 2024 22:14:45 GMT

@PickleRick @yuanliu @yuanliu

So, I did the following tests:
1) User A logged in to Splunk with his user ID using Google Chrome on User A's PC. The result was that Splunk displayed extra spaces correctly using Google Chrome on User A's PC.

2) I login to Splunk with my userID using Google Chrome on my PC. The result was that Splunk does not display extra space correctly using Google Chrome on my PC.

3) User A logged in to Splunk with his user ID using Google Chrome on my PC. The result was that Splunk displayed extra spaces correctly using Google Chrome on my PC. So, it is not an issue with Google Chrome on my PC.

4) I login to Splunk with my userID using Google Chrome on User A's PC. The result was that Splunk does not display extra space correctly using Google Chrome on User A's PC. So, the issue follows my User ID.

The conclusion is: The problem follows my User ID, and it is not an issue with my Google Chrome or my PC.
I am following up with Splunk.

Assuming I am User B, the issue follows User B:

User	Splunk	Browser	PC	Result
User A	User A	User A	User A	No Space issue
User B	User B	User B	User B	Space issue
User A	User B	user B	User B	No Space issue
User B	User A	User A	User A	Space issue

Thanks

Re: Splunk doesn't display extra spaces

johnhuang — Fri, 08 Nov 2024 03:23:30 GMT

Format -> Wrap Results

Re: Splunk doesn't display extra spaces

yuanliu — Fri, 08 Nov 2024 04:55:36 GMT

Very astute observation, @johnhuang ! My default is Wrap Results Yes.

Switch to No, and the spacing changes:

Not sure what the rationale is for this behavior.

Re: Splunk doesn't display extra spaces

LearningGuy — Fri, 08 Nov 2024 13:28:11 GMT

@johnhuang
Changing the wrap results to Yes fix the problem. Thank you so much for your help

Re: Splunk doesn't display extra spaces

PickleRick — Fri, 08 Nov 2024 15:46:07 GMT

When you change the "Wrap results" option, it switches between this CSS

.results-table .wrapped-results td,
.results-table .wrapped-results th {
     white-space:pre-wrap;
}

and the "nowrap" value.

Instead of "nowrap" it probably should use "preserve-spaces" one to be consistent. (or collapse in both cases).

The mystery of collapsing spaces in the source view which I showed is still present however.