https://community.splunk.com/t5/Splunk-Search/Why-is-the-information-column-turning-red-at-search-time/m-p/431396#M123312 <P>While doing a basic raw search, I came across something I've never seen in Splunk -- the information column is turning red for certain logs before working with the data at all. </P> <P>The only significant things about the logs that have the red highlighting is that they have an "error" tag, which I'm assuming is the reason why this is happening. I just didn't know highlighting logs before in the raw format was even possible. </P> <P>If anyone has any idea what's causing this, or how to replicate this, I would be very interested.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5935i0B1830B6232A399B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 20 Oct 2018 00:48:33 GMT rbechtold 2018-10-20T00:48:33Z https://community.splunk.com/t5/Splunk-Search/Why-is-the-information-column-turning-red-at-search-time/m-p/431396#M123312 <P>While doing a basic raw search, I came across something I've never seen in Splunk -- the information column is turning red for certain logs before working with the data at all. </P> <P>The only significant things about the logs that have the red highlighting is that they have an "error" tag, which I'm assuming is the reason why this is happening. I just didn't know highlighting logs before in the raw format was even possible. </P> <P>If anyone has any idea what's causing this, or how to replicate this, I would be very interested.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5935i0B1830B6232A399B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Sat, 20 Oct 2018 00:48:33 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-information-column-turning-red-at-search-time/m-p/431396#M123312 rbechtold 2018-10-20T00:48:33Z https://community.splunk.com/t5/Splunk-Search/Why-is-the-information-column-turning-red-at-search-time/m-p/431397#M123313 <P>These are known as event type renderers and it’s coloring events based on their eventtype.</P> <P>You can configure them via UI or via conf file</P> <P><A href="https://answers.splunk.com/answers/492197/how-to-enable-event-type-coloring.html">https://answers.splunk.com/answers/492197/how-to-enable-event-type-coloring.html</A></P> Sat, 20 Oct 2018 01:15:13 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-the-information-column-turning-red-at-search-time/m-p/431397#M123313 jkat54 2018-10-20T01:15:13Z