Reporting
Highlighted

Timechart abridge values

Communicator

Is it possible to configure Splunk to NOT abridge the values in a timechart? For example, after a graph is displayed I'll hover over a point and get something like:

_time 2011-01-1...000-07:00
/opt/shop...cess_log 1832.024706841

I'd like to be able to see the complete values.

The same goes with the legend:

/opt/emailm...anager.log

Should be

/opt/emailmanager/logs/emailmanager.log
Tags (1)
Highlighted

Re: Timechart abridge values

Splunk Employee
Splunk Employee

Hi!

So, if you look at the Custom charting configuration reference for "Tooltip properties", you'll see there are various "content" properties. For these properties, you can edit the textBlock format for charting, specifically the overflowMode.

View solution in original post

Highlighted

Re: Timechart abridge values

Communicator

Great, that's it. I'm not seeing how to apply the changes on a global level, though. Specifically, when I do a search and click 'Show Report'.

0 Karma
Highlighted

Re: Timechart abridge values

Splunk Employee
Splunk Employee

You can't (easily or supportably or upgradably) do it on a global level, I'm afraid. You'd have to set the properties on each chart in a view.