Reporting

Timechart abridge values

Communicator

Is it possible to configure Splunk to NOT abridge the values in a timechart? For example, after a graph is displayed I'll hover over a point and get something like:

_time 2011-01-1...000-07:00
/opt/shop...cess_log 1832.024706841

I'd like to be able to see the complete values.

The same goes with the legend:

/opt/emailm...anager.log

Should be

/opt/emailmanager/logs/emailmanager.log
Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Hi!

So, if you look at the Custom charting configuration reference for "Tooltip properties", you'll see there are various "content" properties. For these properties, you can edit the textBlock format for charting, specifically the overflowMode.

View solution in original post

Splunk Employee
Splunk Employee

Hi!

So, if you look at the Custom charting configuration reference for "Tooltip properties", you'll see there are various "content" properties. For these properties, you can edit the textBlock format for charting, specifically the overflowMode.

View solution in original post

Splunk Employee
Splunk Employee

You can't (easily or supportably or upgradably) do it on a global level, I'm afraid. You'd have to set the properties on each chart in a view.

Communicator

Great, that's it. I'm not seeing how to apply the changes on a global level, though. Specifically, when I do a search and click 'Show Report'.

0 Karma