Splunk dashboards

[Srini_551]

Hi,

how to add "read more" link options for a table field values if its more than 50 characters in a splunk classic dashboard?

[Srini_551]

Hi,

Thanks for your inputs , its working but not fulfilling the requirements. 

can you share more insights on drilldown option.

example : when we have 2 or more column names with longer text and want to get expand field values for the one column name which we have selected(specific) but not to expand all the columns where this drilldown is used.

[yuanliu]

---

example : when we have 2 or more column names with longer text and want to get expand field values for the one column name which we have selected(specific) but not to expand all the columns where this drilldown is used.

---

My demo dashboard only act on one column named "fieldname".  That is exactly what you describe here.  Can you explain why this does not meet the requirement?  Let's say, you have "fieldname" and "fieldname2" both can get very long.  You set the token on "fieldname" only.  For fieldname2, if you want to make it short, simply do

| eval fieldname2 = substr(fieldname2, 0, 47) . "✂️..."

(47 so there is room for ellipses.)  Here is a full demo

<dashboard version="1.1" theme="light">
  <label>Very long text</label>
  <description>https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-dashboards/m-p/692394#M56730</description>
  <init>
    <set token="reveal_tok">init</set>
  </init>
  <search>
    <query>
      | makeresults format=csv data="reveal
      short"
    </query>
  </search>
  <row>
    <panel>
      <title>reveal = $reveal_tok$</title>
      <table>
        <search>
          <query>| makeresults format=csv data="fieldname, fieldname2
not as long, 2nd field really really really really really loooooooooooooooooong
very very very very very very very very very very loooooooooooooooooooooog, shorter second field"
| rename fieldname as _fieldname
| eval fieldname = if(len(_fieldname) &gt; 50 AND len("$reveal_tok$") &lt; 51, substr(_fieldname, 0, 46) . " ...👉" , _fieldname)
| eval fieldname2 = if(len(fieldname2) &gt; 50, substr(fieldname2, 0, 46) . "✂️...", fieldname2)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="reveal_tok">$row._fieldname$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

[Srini_551]

Hi, 

Thank you so much for your inputs, sorry i didn't convey my question properly.

query :

For example : we have fieldname1, fieldname2,fieldname3 all are long texts. we want to use reveal token and drill down option for all the 3 fieldnames. when i click the fieldname1, it should expand fieldname1 only instead of expanding fieldname1,fieldname2,fieldname3. similarly when i click the fieldname2 , it should expand fieldname2 but not all the three fieldnames, if i click on all the 3 fieldnames then only it should expand all the 3 fieldnames otherwise it should expand based on selection of fieldname.

query2 :

If its possible to have below additional feature then it will be very much helpful.

for example : All 3 fieldnames are column names in a table .table have more than 10  rows with longer text ,is it possible to expand single row and for a single column name/fieldname based on the selection.

Thanks,

Srinivasulu S

[yuanliu]

Two thoughts.  In classic, you can probably use JavaScript to implement mouse-over or similar. (You can produce a "hidden" column named as an internal field, e.g., _fieldname.)  Another method could be to produce the column with ellipses, the use a drilldown to display the full text.

Here is an example of the latter:

<dashboard version="1.1" theme="light">
  <label>Very long text</label>
  <description>https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-dashboards/m-p/692394#M56730</description>
  <init>
    <set token="reveal_tok">init</set>
  </init>
  <search>
    <query>
      | makeresults format=csv data="reveal
      short"
    </query>
  </search>
  <row>
    <panel>
      <title>reveal = $reveal_tok$</title>
      <table>
        <search>
          <query>| makeresults format=csv data="fieldname
not as long
very very very very very very very very very very loooooooooooooooooooooog"
| rename fieldname as _fieldname
| eval fieldname = if(len(_fieldname) &gt; 50 AND len("$reveal_tok$") &lt; 51, substr(_fieldname, 0, 50) . " ...👉" , _fieldname)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="reveal_tok">$row._fieldname$</set>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

When the dashboard loads, the initial value of $reveal_tok$ is set to "init".

If you click that ellipses, the token's value becomes that of _fieldname (which is very long on this row).  The drilldown therefore reveals the full string.

If you click on that short string, $reveal_tok$ becomes the shorter string, therefore the drilldown changes display back to ellipses for very long strings.

There are other ways to do this, depending on your visualization needs and coding style.