width adjustable table

[marendra]

Hi All

If I create table chart on the view, is tehre any way to adjust the width like a normal table?
The problem I have is I am email stats. When it comes to subject, long subject always a problem, since there is no such thing "wrapping" or width adjustment that I can do in Splunk table.
Help, please...

Thanks

Regards

[TonyLeeVT]

This was a pretty slick solution: https://answers.splunk.com/answers/84053/how-to-set-max-column-length.html. But it seemed to slow down presenting the results.

Snippet:
"Easiest was to make it a multivalued field.

 ... | rex field=longfield max_match=0 "(?<longfield>.{0,50})"

that'll split longfield into lines of no more that 50 characters."

[Surender]

Thanks bwooden that works perfect.

Here is my sample for anybody else who is looking for more help.

source=general $env$ $tier$ $srctype$ $leveltok$ (exception=* OR message=* )

| eval level = if(isnotnull(level), level, "Not specified")

|stats count by exception message level sourcetype
| sort - count
| table exception message level sourcetype count
| eval exception=if(len(exception)>100,substr(exception,1,90)+"...",exception)
| eval message=if(len(message)>100,substr(message,1,90)+"...",message)
| eval earliest =$selection.earliest$

| eval latest=$selection.latest$

[bwooden · Accepted solution]

You can place it last via the table command.

... | table sender, recipient, other_fields, subject

Or you can truncate the subject to a specific length. Below we truncate overall length to 20 (including "...")

... | eval subject=if(len(subject)>20,substr(subject,1,17)+"...",subject)

[marendra]

Thanks it works. Is it correct for me saying that there is no way to adjust the column width by drag it like normal table? The only way to do it is pre-format it from the search it self?
What about the wrapping, if the text length is more than what has been defined, it will automatically appear below it?