Splunk Search

Align all values of a table to the left (for PDF export)

Communicator

Hello,

I am currently trying to create a table on which every value, whether number or string, is aligned to the left.
My main reason for this is that I want to export the dashboard that the table is on as PDF, and it just looks really off if the number values are aligned to the right while the other ones are aligned to the left.

Is there a way to do it via simple XML?

Any help is highly appreciated!

0 Karma
1 Solution

Legend

Hi ckunath,
if you don't want to modify CSS the fastest way is to change all numbers in strings using eval command and tostring function, e.g.

| eval amount=tostring(amount,"commas")

Bye.
Giuseppe

View solution in original post

Legend

Hi ckunath,
if you don't want to modify CSS the fastest way is to change all numbers in strings using eval command and tostring function, e.g.

| eval amount=tostring(amount,"commas")

Bye.
Giuseppe

View solution in original post

Path Finder

If the number is < 999 which does not need comma, the PDF export is not aligning properly. Numbers with comma is on one side and without is on another side. is there a better way to align?

Builder

I had the same issue and solved it with zero-width space code (& #8203;)

| eval User = "& #8203;".User

Use it without space in code

0 Karma

Communicator

Thank you for your advise giuseppe! But is there a way to eval the values to string without the commas?
If I just simply do
eval amount=tostring(amount)
without the comma separators, it will still show the numbers on the right hand side in the table and in the .PDF.

0 Karma

Legend

Hi try with

| eval count=printf("%-10d",<your_field>)

beware to the number in printf function, must me greater than quantity of your numbers
see http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConversionFunctions

Bye.
Giuseppe

0 Karma

Communicator

Thanks for the tip! I now however get the error message that, despite what's told in the docs, printf is undefined or unsupported in "eval". Could this be an error due to me using splunk 6.5.2? Or is there a way to fix this?

0 Karma

Legend

yes, this function is present from 6.6.x.
The only way is to modify CSS.
Bye.
Giuseppe

0 Karma