Here is my query:
source="WinEventLog:Application" OR source="WinEventLog:System" |top limit=10 Type,EventCode, SourceName, Message
The message field is long, consequently I cannot see the counts without scrolling. Is there a way to limit the Message fields displayed length? It would be ideal if this could be like HTML where you provide a % instead a hard char limit
If you know how long you want it to show you can append this to your search:
... | fieldformat Message=if(length(Message) > 150, substr(Message, 0, 150) + "...", Message)
If you know how long you want it to show you can append this to your search:
... | fieldformat Message=if(length(Message) > 150, substr(Message, 0, 150) + "...", Message)