Dashboards & Visualizations

SimpleResultsTable - Can it wrap a field

Splunk Employee
Splunk Employee

Is there a way to make SimpleResultsTable wrap a field. (field has a very long event message in it, and i'd like to shrink the size of the module width, but not have a right/left scrollbar), rather i'd like to wrap if possible.

Thoughts?

Tags (2)

Motivator

Depending on what data you display, a second option would be to install the Sideview Utils app, and forego the SimpleResultsTable all together -- use Sideview's HTML module instead. You won't have to mess with the CSS at that point plus you can really control the layout. For a drill down that would show a very large text string (a huge regex) I actually used the HTML module along with <textarea> tags.

So you could do something like this (table is optional, I just like things to line up):

<module name="HTML">
<param name="html"><![CDATA[
        <table border=0>
        <tr><td align=right>Customer:</td><td>$selectedCustomer$</td></tr>
        <tr><td align=right>Some ID:</td><td>$click.fields.someid$</td></tr>
        <tr><td align=right valign=top>String:</td><td><textarea rows="4" cols="200">$results[0].string$</textarea></td></tr>
        <tr><td align=right valign=top>otherstring:</td><td><textarea rows="2" cols="200">$results[0].otherstring$</textarea></td></tr>
        </table>
        ]]></param>
</module>

Make sure you read up on how to use the HTML module in Sideview Utils first, and have a look at the example views included in that app.

Splunk Employee
Splunk Employee

Looking in $SPLUNK_HOME/etc/share/splunk/search_mrsparkle/modules/results/SimpleResultsTable.css, it seems that

.SimpleResultsTable table.simpleResultsTable {
    white-space:nowrap;
}

so you'll probably have to override it to normal at the view level with a CSS file you include in the view XML. (Don't know if you can specify a custom one in Simple XML. If not, and you're using that, then you'll have to override it app-wide in application.css I think.) To be more specific and just do it for one table, I don't know. Sadly, there's no way to push down attributes from modules (e.g., a name or id or class or style) on a visible HTML element as far as I know. You could, I guess, use the cheap and fragile way of finding the object id in a particular view's code and then create a class that applies just to that object. Ugh. By row or column? Make friends with the CSS inspector.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!