I have searched for some traps. The results are not wrapping and I can't scroll any further right. The only way I can view the whole trap is to export it.
I have played with the Options/Display Search Results settings without success.
I am using IE7.
Can anyone help?
Nick - if you are able to post an example, that would be very helpful. This has been a nagging issue I'd like to clean up.
Here is an example, i have the same nagging issue.
This is a Windows security event when someone added a user to a domain group. I am looking to find out who made the change to an account, and which group they added them to. So i have some code to pull out the user information.
index=windows_security_eventlog sourcetype="WinEventLog:Security" (EventCode=4728)
| rex mode=sed field=Message "s/[\r\t]+/ /g"
| eval event_time = strftime(_time, "%Y-%m-%d %H:%M:%S %Z")
| eval changed_by=mvindex(Account_Name,0)
| eval modified_account=mvindex(Account_Name,1)
| table event_id event_time EventCode EventCodeDescription changed_by src_user modified_account user msad_action Group_Name Message
| sort 0 - event_time
My guess is that there are no spaces in the events? The word wrap setting in the little "Options" popup (which is itself a bit hard to discover) -- that setting will only do anything if/when there are spaces in the events. It wont even break at commas or semicolons, hyphens etc. Although I believe the 3.X version used to.
You could customize it by tweaking the CSS in your app a bit. The core CSS involved is in EventsViewer.css which you dont want to edit. However you can override the relevant pieces by putting rules into /etc/apps/<appname>/appserver/static/application.css
.
If this sounds useful I could paste in an example.
This does sound useful, could you paste an example? This happens a lot in our environment and I get users complaining about Splunk's usability because of it. If I can tweak it out of existence that would be nice.
The horizontal scroll bar is all the way at the bottom of the window inside the main frame. You'll need to scroll all the way to the bottom of the page to see it.
OK, that's somewhat helpful. But why aren't the results wrapping? Have any ideas?