I have the problem that I have to have 3 charts in one row. Furthermore I need to have legend on each of these charts. The description of each line has between 20 and 30 characters. I don't want to truncate the description in the legend. What are the possibilities?
Is this possible and how can I do that? I appreciate any help.
Although this is an old thread, I thought I'd add my solution. Often I want labels longer than Splunk default, but not always the full length.
First, do as jihor suggested above and set the option to "ellipsisNone", that way whatever you present will show in its entirity.
At/near the end of your search add (if you were using sourcetype as the label and wanted the first 25 characters) use:
| eval sourcetype = if( len( sourcetype ) > 25, substr( sourcetype, 0, 25 ) +"...", sourcetype )
or whatever you want to summarize the label.
But be aware that when you edit the Dashboard using Splunk UI (not editing the xml directly), on save this will revert back to
ellipsisMiddle. This is a bit annoying.
... <row> <panel> <html> <p>explanations for chart 1 go here...</p> </html> </panel> <panel> <html> <p>explanations for chart 2 go here...</p> </html> </panel> <panel> <html> <p>explanations for chart 3 go here...</p> </html> </panel> </row> ...