Splunk Search

How to truncate a string to fit in a table, but still be able to see the full string if clicked on?

Communicator

I have a table where sometimes the value of a field can be a very, very long string. I want this to be shown in a truncated form, but still have the option to see the full string somehow. Is this possible?

Many thanks,
John

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi John

I assume you are working on a dashboard, so I suggest using the fieldformat or eval command to create a truncated version of the field

| eval truncated=replace(mylongfield,"^(.{5}).*",\1)."..."

This eval will create a condensed version of the field called truncated, which includes the first 5 characters followed by an ellipses.

Then you can use an in-page (contextual) drilldown that will populate a second panel with in the same dashboard with the full version of the text when the truncated version is clicked. The link below will show you how to do it in simple xml. If you are experienced with Javascript, you can convert the dashboard to html and do this as an info box on hover.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Understandbasictableandchartdrilldownactions#C...

View solution in original post

Splunk Employee
Splunk Employee

Hi John

I assume you are working on a dashboard, so I suggest using the fieldformat or eval command to create a truncated version of the field

| eval truncated=replace(mylongfield,"^(.{5}).*",\1)."..."

This eval will create a condensed version of the field called truncated, which includes the first 5 characters followed by an ellipses.

Then you can use an in-page (contextual) drilldown that will populate a second panel with in the same dashboard with the full version of the text when the truncated version is clicked. The link below will show you how to do it in simple xml. If you are experienced with Javascript, you can convert the dashboard to html and do this as an info box on hover.

http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/Understandbasictableandchartdrilldownactions#C...

View solution in original post

Communicator

Thanks very much!

0 Karma

Esteemed Legend

That is pretty much what I said, too.

0 Karma

Esteemed Legend

This is one of the use cases for fieldformat. It causes the field to maintain it's original value (so that drill down is not broken) but it has another value that you set whenever it is displayed.

0 Karma

Communicator

Thanks. I see that this would let you hide some of the text, but how do you allow the user to click to see the whole string?

0 Karma