This was a pretty slick solution: https://answers.splunk.com/answers/84053/how-to-set-max-column-length.html. But it seemed to slow down presenting the results. Snippet: "Easiest was to make it a multivalued field. ... | rex field=longfield max_match=0 "(?<longfield>.{0,50})" that'll split longfield into lines of no more that 50 characters." ... View more

Hi Thanks a lot. Unfortunately, it couldn't work for my case. Anyway, it is a good link you gave me there. Thanks again Regards ... View more

So it seems like the default drilldown from your dashboard table is not passing the whole query/correct query to flashtimeline, so you are getting no data. you might have a Redirector module within your table module. you can configure it to pass the exact query that you want to pass in the arg.q parameter. You can customize it with the row/field user clicked. <module name="Redirector"> <param name="popup">True</param> <param name="url">flashtimeline</param> <param name="arg.earliest">$search.timeRange.earliest$</param> <param name="arg.latest">$search.timeRange.latest$</param> <param name="arg.q">search index=$index$ sourcetype="$sourcetype$" source="$source$" $click.fields.Field Name$</param> </module> ... View more

Just need to select HOST as Apply To and * in named field as below while Lookups » Automatic lookups » Add new No need to edit Props.conf gile Thanks Neeraj Singh Dhapola ... View more

Hi southeringtonp Fantastic, it works... Thank you very much. ... View more