Dashboards & Visualizations

Legend Truncates

Jamietriplet
Explorer

How can i prevent truncation of the legend on a classic Splunk dashboard? The output has an ellipsis in the middle of my Legend, but i want to show the full text on the legend. See my query below:

index=$ss_name$_$nyName_tok$_ sourcetype=plt (Instrument="ZT2" OR Instrument="XY2" OR Instrument="P4")
| rex field=Instrument "(Calculated)\.(?<tag>.+)$$"
| timechart span=$span$ max(ValueEng) by tag

Thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't go in the query. The legend is a feature of the viz. The charting option goes in the SimpleXML source.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

 

View solution in original post

Jamietriplet
Explorer

Hello @ITWhisperer this worked. Thanks for your help

0 Karma

Jamietriplet
Explorer

@gcusello Please can you help?

How can i prevent truncation of the legend on a classic Splunk dashboard? The output has an ellipsis in the middle of my Legend, but i want to show the full text on the legend. See my query below:

index=$ss_name$_$nyName_tok$_ sourcetype=plt (Instrument="ZT2" OR Instrument="XY2" OR Instrument="P4")
| rex field=Instrument "(Calculated)\.(?<tag>.+)$$"
| timechart span=$span$ max(ValueEng) by tag

 

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is not much that can be done apart from placing the legend at the top or bottom of the chart. If you still get truncated names, then look to shorten them in your search.

Jamietriplet
Explorer

Hi @ITWhisperer , thanks for your reply. I can not shorten this as i need the full length of the legend. Also i have tried to move it to the top or bottom but i get same output. I want to actually set ellipsis to none, but i am not sure where to place this in search query

 

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There are charting options you could try but with long legends this still may not be enough

charting.legend.labelStyle.overflowMode(ellipsisEnd | ellipsisMiddle | ellipsisNone | ellipsisStart)ellipsisMiddleDetermines how to display labels that overflow layout bounds by replacing elided text with an ellipsis (...).

ellipsisStart: Elides text at the start.

ellipsisMiddle: Elides text in the middle of the line.

ellipsisEnd: Elides text at the layout boundary.

ellipsisNone: Disables text truncation entirely.

Jamietriplet
Explorer

This would be helpful, but where do i place this in the below query?

index=$ss_name$_$nyName_tok$_ sourcetype=plt (Instrument="ZT2" OR Instrument="XY2" OR Instrument="P4")
| rex field=Instrument "(Calculated)\.(?<tag>.+)$$"
| timechart span=$span$ max(ValueEng) by tag

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It doesn't go in the query. The legend is a feature of the viz. The charting option goes in the SimpleXML source.

https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

 

Jamietriplet
Explorer

hello @ITWhisperer This worked. Thanks for your help

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...