Timechart abridge values

[nocostk]

Is it possible to configure Splunk to NOT abridge the values in a timechart? For example, after a graph is displayed I'll hover over a point and get something like:

_time 2011-01-1...000-07:00
/opt/shop...cess_log 1832.024706841

I'd like to be able to see the complete values.

The same goes with the legend:

/opt/emailm...anager.log

Should be

/opt/emailmanager/logs/emailmanager.log

[sophy · Accepted solution]

Hi!

So, if you look at the Custom charting configuration reference for "Tooltip properties", you'll see there are various "content" properties. For these properties, you can edit the textBlock format for charting, specifically the overflowMode.

[gkanapathy]

You can't (easily or supportably or upgradably) do it on a global level, I'm afraid. You'd have to set the properties on each chart in a view.

[nocostk]

Great, that's it. I'm not seeing how to apply the changes on a global level, though. Specifically, when I do a search and click 'Show Report'.