Solved: How to deal with extremely long values in table vi...

NoSpaces · ‎08-04-2025

Hello everyone!
I'm trying to create a table view of IIS logs.
The main issue I've encountered is some very long URL fields.
In similar situations elsewhere, I've seen interactive "URL wrapping" — like clicking or hovering to reveal the full link.
But Splunk's table view doesn't seem to offer anything like that.
How can I handle this?

livehybrid · ‎08-04-2025

Heres a 3rd option if its helpful?

This starts off with a hidden panel, clicking on the row in the table sets a token containing the full URL, which unhides the panel and displays the full URL for the clicked row.

<dashboard version="1.1">
  <label>Long URL demo (makeresults + hidden full value)</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=5
| streamstats count
| eval schemes=split("https,https,https,http,http", ",")
| eval hosts=split("alpha.example.com,beta.example.org,gamma.example.net,delta.example.io,epsilon.example.dev", ",")
| eval paths=split("shop/products/42,blog/2024/10/15/welcome,api/v1/users/12345/profile,media/images/2024/10/banner,docs/guides/install/linux", ",")
| eval queries=split("ref=newsletter&amp;utm=fall,?tag=splunk&amp;src=forum,?session=abc123&amp;feature=beta,?size=large&amp;color=blue,?step=1&amp;mode=advanced", ",")
| eval fragments=split("#top,#comments,#details,#preview,#faq", ",")
| eval url_full=mvindex(schemes,count-1)."://".mvindex(hosts,count-1)."/".mvindex(paths,count-1).mvindex(queries,count-1).mvindex(fragments,count-1)
| eval host="web-server-00".count
| eval _full_url=url_full
| eval url_display=if(len(url_full)&gt;60, substr(url_full,1,60)."…", url_full)
| table host url_display _full_url</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="full_url_token">$row._full_url$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$full_url_token$">
    <panel>
      <html>
        <h3>Full URL</h3>
        <p>$full_url_token$</p>
      </html>
    </panel>
  </row>
</dashboard>

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

bowesmana · ‎08-04-2025

The old Splunk dashboard examples app

https://classic.splunkbase.splunk.com/app/1603/

which although no longer supported, can be downloaded and you can get an idea of how to write some extensions that would, for example, give you a tooltip on hover over the URL, depending on your level of css/javascript skills.

livehybrid · ‎08-04-2025

Heres a 3rd option if its helpful?

This starts off with a hidden panel, clicking on the row in the table sets a token containing the full URL, which unhides the panel and displays the full URL for the clicked row.

<dashboard version="1.1">
  <label>Long URL demo (makeresults + hidden full value)</label>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=5
| streamstats count
| eval schemes=split("https,https,https,http,http", ",")
| eval hosts=split("alpha.example.com,beta.example.org,gamma.example.net,delta.example.io,epsilon.example.dev", ",")
| eval paths=split("shop/products/42,blog/2024/10/15/welcome,api/v1/users/12345/profile,media/images/2024/10/banner,docs/guides/install/linux", ",")
| eval queries=split("ref=newsletter&amp;utm=fall,?tag=splunk&amp;src=forum,?session=abc123&amp;feature=beta,?size=large&amp;color=blue,?step=1&amp;mode=advanced", ",")
| eval fragments=split("#top,#comments,#details,#preview,#faq", ",")
| eval url_full=mvindex(schemes,count-1)."://".mvindex(hosts,count-1)."/".mvindex(paths,count-1).mvindex(queries,count-1).mvindex(fragments,count-1)
| eval host="web-server-00".count
| eval _full_url=url_full
| eval url_display=if(len(url_full)&gt;60, substr(url_full,1,60)."…", url_full)
| table host url_display _full_url</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <set token="full_url_token">$row._full_url$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row depends="$full_url_token$">
    <panel>
      <html>
        <h3>Full URL</h3>
        <p>$full_url_token$</p>
      </html>
    </panel>
  </row>
</dashboard>

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

NoSpaces · ‎08-05-2025

I just tested this approach and think that, at least for now, it suits my goal.

PickleRick · ‎08-04-2025

I'm not aware of any built-in visualization component providing such functionality. In simpleXML dashboard you could probably do that with custom JS.

Of course @livehybrid 's idea can shorten your data if it's over a certain limit but you're left with just a shortened version - no "click to unwrap" functionality.

NoSpaces · ‎08-05-2025

@livehybrid idea with an on-top row for the full URL is pretty close to what I wanted to achieve.
As for filtering or searching by the full URL, I can still do it using something like:

| search _full_url="*$token_for_search$*"

livehybrid · ‎08-04-2025

Further to my other reply, if you just want to truncate you could use substr() function:

| eval url_chunked=substr(url_full,0,50)."..."

Full example:

| makeresults count=1
| eval SomeField="Some Value"
| eval host="web-server-001"
| eval url_full="https://example.com/a/very/long/path/that/goes/on/and/on/and/on/until/it/reaches_the/really/really/far/end/adding/more/segments/to/demonstrate/excessive/length/in/this/uri/string/exceeding/every/reasonable/limit/for/display/in/default/table/view"
| eval url_chunked=substr(url_full,0,50)."..."
| fields - url_full

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

livehybrid · ‎08-04-2025

Hi @NoSpaces

You can use a REX command with multiple match allowance/limit to chunk the url into the length required, this would then split it across multiple lines, would this help?

| rex max_match=100 field=url_full "(?<url_chunked>[\S]{1,50})"

Full example:

| makeresults count=1
| eval SomeField="Some Value"
| eval host="web-server-001"
| eval url_full="https://example.com/a/very/long/path/that/goes/on/and/on/and/on/until/it/reaches_the/really/really/far/end/adding/more/segments/to/demonstrate/excessive/length/in/this/uri/string/exceeding/every/reasonable/limit/for/display/in/default/table/view"
| rex max_match=100 field=url_full "(?<url_chunked>[\S]{1,50})"
| fields - url_full

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

How to deal with extremely long values in table view?

administration

Can’t make it to .conf25? Join us online!

Community Content Calendar, September edition

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you a member of the Splunk Community?

How to deal with extremely long values in table view?

administration

Can’t make it to .conf25? Join us online!

Community Content Calendar, September edition

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem