I have the problem that I have to have 3 charts in one row. Furthermore I need to have legend on each of these charts. The description of each line has between 20 and 30 characters. I don't want to truncate the description in the legend. What are the possibilities?
Is this possible and how can I do that? I appreciate any help.
Although this is an old thread, I thought I'd add my solution. Often I want labels longer than Splunk default, but not always the full length.
First, do as jihor suggested above and set the option to "ellipsisNone", that way whatever you present will show in its entirity.
At/near the end of your search add (if you were using sourcetype as the label and wanted the first 25 characters) use:
| eval sourcetype = if( len( sourcetype ) > 25, substr( sourcetype, 0, 25 ) +"...", sourcetype )
or whatever you want to summarize the label.
But be aware that when you edit the Dashboard using Splunk UI (not editing the xml directly), on save this will revert back to
ellipsisMiddle. This is a bit annoying.
... <row> <panel> <html> <p>explanations for chart 1 go here...</p> </html> </panel> <panel> <html> <p>explanations for chart 2 go here...</p> </html> </panel> <panel> <html> <p>explanations for chart 3 go here...</p> </html> </panel> </row> ...
Then your charts are too narrow... have you considered sticking to only naming each series in the chart and providing a detailed description in an HTML box underneath?
Do you have an example for such a HTML box?
Unfortunatly that's even worse. I can see only something like this: -... -... -... -... -...
You can try moving the legend to the bottom of the graph, that might give you more space for longer names.