Dashboards & Visualizations

Add newline into table cell?

inglisn
Path Finder

Hi,

I'm splunking some network traffic and want to generate a table showing the peak hour for different categories of data, for each day through a week. To add some context I'd like to embed more information (e.g. total throughput) into the table cell which I can do using eval to generate a result string.

Is there any way of creating a newline within the result string so that the values wrap onto multiple lines?

Thanks

Tags (1)
1 Solution

Ayn
Legend

You can do this by tweaking the CSS for the table you want wrapped text in (so you might need to create your own app so your CSS tweak doesn't affect everything else as well...)

To get wrapped text in the results table, define the following CSS in <app_root>/appserver/static/application.css:

.SimpleResultsTable table.simpleResultsTable {
    white-space:pre-line;
}

View solution in original post

nagendra008
Explorer

Hi inglisn,

If you want to see the newline inside the table cell.
I tried using [ yoursearch | rex mode=sed field=Category "s/,/\n/g" | .... ], But i see space instead of newline.

Try this if you have a delimiter in the string for a field Category like shown in example : Cat1, Cat2
you can try to use split ( your search |eval Category = split(Category,",")| ....... ) after using all the methods split works fine for my case.
Hope this will help you.

Example :

No Category Count
1 Cat1, Cat2 5
2 Cat5, Cat6 9

Desired output :

No Category Count
1 Cat1 5
Cat2

2 Cat5 9
Cat6

Thanks.

spunk311z
Path Finder

thanks!  this worked great for me as well.  (nagendra008 's split method , not the css way)

(i didnt want to mess with CSS nor make a new app for a quick table).

if this helps others,  i used the blank space as the linebreak / replace char;

| eval dateonly=strftime(_time, "%m-%d %A %I:%M%P") | eval dateonly= split(dateonly," ")

so i ended up with exactly what i wanted  🙂  -

spunk311z_0-1597515299128.png 

vs this before 😐

spunk311z_0-1597515404832.png

(unrelated- what is up with the login process for the forums here?  its now login on page 1, pw on page2, which breaks chrome and FF password save/remember.  maybe they are doing this to fight off bruteforce/bots?  etherway its pretty annoying as i now have to lookup + type both 😞  

0 Karma

harry2007gsp
Path Finder

This was extremely useful. I have been looking for this for long.
Thank you @nagendra008

0 Karma

bsanch2
Path Finder

Split worked great, just what I was looking for!

0 Karma

ZacEsa
Communicator

Using split works for me.

0 Karma

marcellodesales
Path Finder

Split worked for me as well...!

Ayn
Legend

You can do this by tweaking the CSS for the table you want wrapped text in (so you might need to create your own app so your CSS tweak doesn't affect everything else as well...)

To get wrapped text in the results table, define the following CSS in <app_root>/appserver/static/application.css:

.SimpleResultsTable table.simpleResultsTable {
    white-space:pre-line;
}

inglisn
Path Finder

Thanks. Works well, although getting into the guts of CSS is something I was hoping to avoid.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...