How to truncate a string to fit in a table, but still be able to see the full string if clicked on?

[johnraftery]

I have a table where sometimes the value of a field can be a very, very long string. I want this to be shown in a truncated form, but still have the option to see the full string somehow. Is this possible?

Many thanks,
John

[dcarmack_splunk · Accepted solution]

Hi John

I assume you are working on a dashboard, so I suggest using the fieldformat or eval command to create a truncated version of the field

| eval truncated=replace(mylongfield,"^(.{5}).*",\1)."..."

This eval will create a condensed version of the field called truncated, which includes the first 5 characters followed by an ellipses.

Then you can use an in-page (contextual) drilldown that will populate a second panel with in the same dashboard with the full version of the text when the truncated version is clicked. The link below will show you how to do it in simple xml. If you are experienced with Javascript, you can convert the dashboard to html and do this as an info box on hover.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Understandbasictableandchartdrilldownactions#C...

[johnraftery]

Thanks very much!

[woodcock]

That is pretty much what I said, too.

[woodcock]

This is one of the use cases for fieldformat. It causes the field to maintain it's original value (so that drill down is not broken) but it has another value that you set whenever it is displayed.

[johnraftery]

Thanks. I see that this would let you hide some of the text, but how do you allow the user to click to see the whole string?