example : when we have 2 or more column names with longer text and want to get expand field values for the one column name which we have selected(specific) but not to expand all the columns where t...
See more...
example : when we have 2 or more column names with longer text and want to get expand field values for the one column name which we have selected(specific) but not to expand all the columns where this drilldown is used. My demo dashboard only act on one column named "fieldname". That is exactly what you describe here. Can you explain why this does not meet the requirement? Let's say, you have "fieldname" and "fieldname2" both can get very long. You set the token on "fieldname" only. For fieldname2, if you want to make it short, simply do | eval fieldname2 = substr(fieldname2, 0, 47) . " ..." (47 so there is room for ellipses.) Here is a full demo <dashboard version="1.1" theme="light">
<label>Very long text</label>
<description>https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-dashboards/m-p/692394#M56730</description>
<init>
<set token="reveal_tok">init</set>
</init>
<search>
<query>
| makeresults format=csv data="reveal
short"
</query>
</search>
<row>
<panel>
<title>reveal = $reveal_tok$</title>
<table>
<search>
<query>| makeresults format=csv data="fieldname, fieldname2
not as long, 2nd field really really really really really loooooooooooooooooong
very very very very very very very very very very loooooooooooooooooooooog, shorter second field"
| rename fieldname as _fieldname
| eval fieldname = if(len(_fieldname) > 50 AND len("$reveal_tok$") < 51, substr(_fieldname, 0, 46) . " ... " , _fieldname)
| eval fieldname2 = if(len(fieldname2) > 50, substr(fieldname2, 0, 46) . " ...", fieldname2)</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">cell</option>
<option name="refresh.display">progressbar</option>
<drilldown>
<set token="reveal_tok">$row._fieldname$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>