<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic how to set max column length in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96586#M24957</link>
    <description>&lt;P&gt;What is the best possible function to limit a column to not exceed a specified character count or is there a way to word wrap to the next line after it has been reached?&lt;/P&gt;</description>
    <pubDate>Tue, 16 Apr 2013 20:19:33 GMT</pubDate>
    <dc:creator>aaronkorn</dc:creator>
    <dc:date>2013-04-16T20:19:33Z</dc:date>
    <item>
      <title>how to set max column length</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96586#M24957</link>
      <description>&lt;P&gt;What is the best possible function to limit a column to not exceed a specified character count or is there a way to word wrap to the next line after it has been reached?&lt;/P&gt;</description>
      <pubDate>Tue, 16 Apr 2013 20:19:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96586#M24957</guid>
      <dc:creator>aaronkorn</dc:creator>
      <dc:date>2013-04-16T20:19:33Z</dc:date>
    </item>
    <item>
      <title>Re: how to set max column length</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96587#M24958</link>
      <description>&lt;P&gt;Yep.&lt;/P&gt;

&lt;P&gt;Easiest was to make it a multivalued field.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;... | rex field=longfield max_match=0 "(?&amp;lt;longfield&amp;gt;.{0,50})"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;that'll split longfield into lines of no more that 50 characters.&lt;/P&gt;</description>
      <pubDate>Tue, 16 Apr 2013 20:57:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96587#M24958</guid>
      <dc:creator>jonuwz</dc:creator>
      <dc:date>2013-04-16T20:57:40Z</dc:date>
    </item>
    <item>
      <title>Re: how to set max column length</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96588#M24959</link>
      <description>&lt;P&gt;If you want to truncate a result column after certain length, use this...&lt;/P&gt;

&lt;P&gt;| eval source = if  (len(source) &amp;gt; 58,  substr(source, 1, 55)  +  "...",   source) &lt;/P&gt;</description>
      <pubDate>Sat, 01 Nov 2014 12:57:35 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96588#M24959</guid>
      <dc:creator>tv5</dc:creator>
      <dc:date>2014-11-01T12:57:35Z</dc:date>
    </item>
    <item>
      <title>Re: how to set max column length</title>
      <link>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96589#M24960</link>
      <description>&lt;P&gt;This is an awesome solution, but it seems to take a long time to "Finalize" the search results for a large number of returned values.&lt;/P&gt;

&lt;P&gt;Can we think of anything that is faster?  Otherwise, it would be ideal if Splunk could just provide column width control without going to .css.&lt;/P&gt;</description>
      <pubDate>Tue, 10 May 2016 20:09:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/how-to-set-max-column-length/m-p/96589#M24960</guid>
      <dc:creator>TonyLeeVT</dc:creator>
      <dc:date>2016-05-10T20:09:40Z</dc:date>
    </item>
  </channel>
</rss>

