So, we have many log messages, a reasonable number of which may contain stacktraces. Displaying the log messages in a table seems the most logical way to present the data, however with a properly formatted stacktrace, the height of a table row is often greater than the height of the screen, which makes looking through log messages a pain due to the amount of scrolling and paging required. The only implementations for showing stacktraces I can come up with so far include:
- putting up with the excessive row height (which makes looking at log entries difficult when only one log entry appears on the screen at a time)
- trimming the stack trace to just a few lines (which risks cutting off important/relevant stack trace information)
Both have their disadvantages. The ideal solution would be the ability to expand a table row/cell for more detail, allowing only the first line of a stacktrace to be shown, but could be expanded to the full stack trace. Is this possible in Splunk? How have others tackled this user experience issue of effectively displaying stack traces with easy access to all the relevant info in it?
