Solved: Customize table width in results of drilldown to a...

mythili · ‎11-30-2023

Hi All,

How do you customize the table width of results of custom search from a drilldown? I am not able to find any documentation on this.

ITWhisperer · ‎12-01-2023

Correct - this drilldown will run Splunk's Search app over which you have little control, however, if you drilldown to your own dashboard, you have much more control on the presentation.

View solution in original post

bowesmana · ‎11-30-2023

I don't follow how the drilldown is related, but you can format the table column widths using this css in your dashboards

  <row depends="$AlwaysHideCSS$">
    <panel>
      <html>
        <style>
#table_id th[data-sort-key=Name] {
    width: 20% !important;
}
        </style>
      </html>
    </panel>
  </row>

and your table is defined with the id

<table id="table_id">...

mythili · ‎11-30-2023

Hi @bowesmana ,
This works when I use table in the dashboard. However for custom search from drilldown, the structure is a below:
<drilldown>
<link target="_blank">search?xxxxxxxxxxxxx(custom search)|table field_1 field_2 ;earliest=$time_selection_earliest$&latest=$time_selection_latest$</link>
</drilldown>

I cannot add the table id as "id" is an invalid attribute for both drilldown and link tags.

bowesmana · ‎12-03-2023

As @ITWhisperer says, if this drilldown is taking you to a search in a new Splunk window, then you have no control over the format 🙁

ITWhisperer · ‎12-01-2023

Correct - this drilldown will run Splunk's Search app over which you have little control, however, if you drilldown to your own dashboard, you have much more control on the presentation.

Customize table width in results of drilldown to a custom search from dashboard

CSS

dashboard

drilldown

table

Enterprise Security Content Update (ESCU) | New Releases

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

Index This | What are the 12 Days of Splunk-mas?