https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189529#M54598 <P>You have not told us <EM>where</EM> you are seeing your data.<BR /> 1: Is it on the events tab as a selected field? <BR /> 2: Is it on the statistics tab as a value in a column? <BR /> 3: Is it on the visualization tab; if so, what visualization are you using? </P> <P>I will assume the problem is #1 and the solution is to add this to move to #2 which should not have this problem:</P> <PRE><CODE>... | table * </CODE></PRE> <P>If you ask questions better, you will get better answers.</P> Fri, 03 Jul 2015 01:25:01 GMT woodcock 2015-07-03T01:25:01Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189528#M54597 <P>The results of my queries in Splunk are truncated ie, it only shows:</P> <P>source =/data/logs/sdf/sdfdsfds/f/sdf/dsf/dsf/dsf/dsf/d/fsd/fd/sf/sdf/sd/fsd/f/sdf/sd/fs/dfggd/f…</P> <P>when I instead want to see the full log name</P> <P>source =/data/logs/sdf/sdfdsfds/f/sdf/dsf/dsf/dsf/dsf/d/fsd/fd/sf/sdf/sd/fsd/f/sdf/sd/fs/dfggd/fsd/fs/ftest.log</P> <P>Can it be configured in Splunk to expand the source field to show the full field value by default?</P> <P>FYI it seems like the source field has a max length of 90 characters including the 3 dots.</P> <P>Thanks in advance.</P> <P>Jackie</P> Thu, 02 Jul 2015 15:52:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189528#M54597 jackiewkc 2015-07-02T15:52:15Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189529#M54598 <P>You have not told us <EM>where</EM> you are seeing your data.<BR /> 1: Is it on the events tab as a selected field? <BR /> 2: Is it on the statistics tab as a value in a column? <BR /> 3: Is it on the visualization tab; if so, what visualization are you using? </P> <P>I will assume the problem is #1 and the solution is to add this to move to #2 which should not have this problem:</P> <PRE><CODE>... | table * </CODE></PRE> <P>If you ask questions better, you will get better answers.</P> Fri, 03 Jul 2015 01:25:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189529#M54598 woodcock 2015-07-03T01:25:01Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189530#M54599 <P>Thanks for the reply. And yes, I was talking about the event tab. And the scenario is that when I do a simple search like "index=abc". you can see the events in the events tab with ... as part of the source when it is longer than 90 characters. I wanted to know if it is possible to configure Splunk to simply show the complete values of the soruce field in the normal search result without doing anything like table * to alter how the results are displayed.<BR /> Based on your reply, I take it the answer is no. If this is not the case and in fact there is a way to do it, please do let me know.<BR /> Thanks.</P> Fri, 03 Jul 2015 10:25:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189530#M54599 jackiewkc 2015-07-03T10:25:18Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189531#M54600 <P>I am unaware of any way to control this, but that is not to say it is impossible. I would raise a support case with Splunk and ask them to add this as a feature and they will tell you if there is some arcane setting somewhere (unlikely).</P> Fri, 03 Jul 2015 13:48:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-complete-source-without/m-p/189531#M54600 woodcock 2015-07-03T13:48:20Z