Splunk Search

width adjustable table

marendra
Explorer

Hi All

If I create table chart on the view, is tehre any way to adjust the width like a normal table?
The problem I have is I am email stats. When it comes to subject, long subject always a problem, since there is no such thing "wrapping" or width adjustment that I can do in Splunk table.
Help, please...

Thanks

Regards

Tags (1)
1 Solution

bwooden
Splunk Employee
Splunk Employee

You can place it last via the table command.

... | table sender, recipient, other_fields, subject

Or you can truncate the subject to a specific length. Below we truncate overall length to 20 (including "...")

... | eval subject=if(len(subject)>20,substr(subject,1,17)+"...",subject)

View solution in original post

TonyLeeVT
Builder

This was a pretty slick solution: https://answers.splunk.com/answers/84053/how-to-set-max-column-length.html. But it seemed to slow down presenting the results.

Snippet:
"Easiest was to make it a multivalued field.

 ... | rex field=longfield max_match=0 "(?<longfield>.{0,50})"

that'll split longfield into lines of no more that 50 characters."

Surender
Explorer

Thanks bwooden that works perfect.

Here is my sample for anybody else who is looking for more help.

source=general $env$ $tier$ $srctype$ $leveltok$ (exception=* OR message=* )

| eval level = if(isnotnull(level), level, "Not specified")

|stats count by exception message level sourcetype
| sort - count
| table exception message level sourcetype count
| eval exception=if(len(exception)>100,substr(exception,1,90)+"...",exception)
| eval message=if(len(message)>100,substr(message,1,90)+"...",message)
| eval earliest =$selection.earliest$

| eval latest=$selection.latest$

bwooden
Splunk Employee
Splunk Employee

You can place it last via the table command.

... | table sender, recipient, other_fields, subject

Or you can truncate the subject to a specific length. Below we truncate overall length to 20 (including "...")

... | eval subject=if(len(subject)>20,substr(subject,1,17)+"...",subject)

View solution in original post

marendra
Explorer

Thanks it works. Is it correct for me saying that there is no way to adjust the column width by drag it like normal table? The only way to do it is pre-format it from the search it self?
What about the wrapping, if the text length is more than what has been defined, it will automatically appear below it?

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!