Is it possible to configure Splunk to NOT abridge the values in a timechart? For example, after a graph is displayed I'll hover over a point and get something like:
_time 2011-01-1...000-07:00 /opt/shop...cess_log 1832.024706841
I'd like to be able to see the complete values.
The same goes with the legend:
So, if you look at the Custom charting configuration reference for "Tooltip properties", you'll see there are various "content" properties. For these properties, you can edit the textBlock format for charting, specifically the
Great, that's it. I'm not seeing how to apply the changes on a global level, though. Specifically, when I do a search and click 'Show Report'.
You can't (easily or supportably or upgradably) do it on a global level, I'm afraid. You'd have to set the properties on each chart in a view.