Solved: Re: Customize table width in results of drilldown ...

mythili · ‎11-30-2023

Hi All,

How do you customize the table width of results of custom search from a drilldown? I am not able to find any documentation on this.

ITWhisperer · ‎12-01-2023

Correct - this drilldown will run Splunk's Search app over which you have little control, however, if you drilldown to your own dashboard, you have much more control on the presentation.

View solution in original post

bowesmana · ‎11-30-2023

I don't follow how the drilldown is related, but you can format the table column widths using this css in your dashboards

  <row depends="$AlwaysHideCSS$">
    <panel>
      <html>
        <style>
#table_id th[data-sort-key=Name] {
    width: 20% !important;
}
        </style>
      </html>
    </panel>
  </row>

and your table is defined with the id

<table id="table_id">...

mythili · ‎11-30-2023

Hi @bowesmana ,
This works when I use table in the dashboard. However for custom search from drilldown, the structure is a below:
<drilldown>
<link target="_blank">search?xxxxxxxxxxxxx(custom search)|table field_1 field_2 ;earliest=$time_selection_earliest$&latest=$time_selection_latest$</link>
</drilldown>

I cannot add the table id as "id" is an invalid attribute for both drilldown and link tags.

bowesmana · ‎12-03-2023

As @ITWhisperer says, if this drilldown is taking you to a search in a new Splunk window, then you have no control over the format 🙁

ITWhisperer · ‎12-01-2023

Correct - this drilldown will run Splunk's Search app over which you have little control, however, if you drilldown to your own dashboard, you have much more control on the presentation.

Customize table width in results of drilldown to a custom search from dashboard

CSS

dashboard

drilldown

table

Reduce and Transform Your Firewall Data with Splunk Data Management

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Are you a member of the Splunk Community?