i have in a table the result of a scanning script. Of course, the cells are much too large. Is there a way to minimize them and maximize them if necessary?
A drill down to a new page would be also ok, but how can I shorten or change the text in the cell so that the drilldown function is still possible since I use "clickvalue".
you could use subsearch to define the max lenght of a field and using drilldopwn, you could open a new panel containing the full field.
| eval your_field=substr(your_field,"10")
thanks for your fast reply. Can u say me, what is the best way to drilldown the colum and open a new panel containing the full field?
try to adapt this sample to your situation:
<dashboard version="1.1"> <label>In-page Drilldown with Perma-Linking</label> <description>Enable in-page interaction through UI Editor or editing XML.</description> <row> <panel> <title>Main panel</title> <table id="master"> <search> <query> index=your_index | eval visualized_field=substr(your_field,1,10) | table _time host visualized_field your_field </query> <earliest>-60m@m</earliest> <latest>now</latest> </search> <fields>_time, host, visualized_field</fields> <option name="drilldown">cell</option> <drilldown> <set token="form.your_field">$row.your_field$</set> </drilldown> </table> </panel> <panel> <chart id="detail" depends="$your_field$"> <title>Detail: $your_field$</title> <search> <query> index=your_index your_field="$your_field$" | table your_field </query> <earliest>-60m@m</earliest> <latest>now</latest> </search> </chart> </panel> </row> </dashboard>
In few words:
I hint to see in the Splunk Dashboard Examples App (https://splunkbase.splunk.com/app/1603/) because you can find examples of in-page drilldown.