topic Re: Assign colour's based on the field value in Splunk Search

Assign colour's based on the field value

ravidudala — Tue, 06 Mar 2018 10:50:54 GMT

Hi Splunkers,

I have the below query

( (index=xxx sourcetype=xxx severity=xxx intelId=xxx ) ) | eval intelId = case(match(intelId ,"xxx"),"Test1",match(intelId ,"XX"),"Test2") | eval intelId = severity+":"+intelId | timechart usenull=f span=1d count by intelId

So this query gives me the information in a chart with serverity+ the field name, for example for INFO it will INFO: Test1.

I was trying to give colors to the column chart with the following condition

"{"ERROR:":0xcc0000,"FATAL:":0xff9900,"INFO:":0x339933,"DEBUG:":0x6699ff}"

My goal is to achieve color based on the severity - But the above option doesn't seem to work.

Any inputs on this are much appreciated.

Thanks | RD

Re: Assign colour's based on the field value

493669 — Tue, 06 Mar 2018 14:11:44 GMT

try this:

<option name="charting.fieldColors">
          {"ERROR": 0xFF0000, "FATAL": 0xFF9900 ,"INFO": 0xFF9900, "DEBUG":0x0066FF}
</option>

Reference: https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/ChartConfigurationReference

Re: Assign colour's based on the field value

niketn — Tue, 06 Mar 2018 14:57:43 GMT

@ravidudala, Based on your query seems like you have Two series Test1 and Test2 and four SLAs i.e. ERROR FATAL INFO and DEBUG. You can define 8 field colors in this case:

 <option name="charting.fieldColors">{"ERROR:Test1": 0xFF0000, "FATAL:Test1": 0xFF9900 ,"INFO:Test1": 0xFF9900, "DEBUG:Test1":0x0066FF,"ERROR:Test2": 0xFF0000, "FATAL:Test2": 0xFF9900 ,"INFO:Test2": 0xFF9900, "DEBUG:Test2":0x0066FF}</option>

The charting.fieldColors option looks for complete field name as it is and does not support wildcard characters like asterisk *

Re: Assign colour's based on the field value

ravidudala — Thu, 08 Mar 2018 09:34:29 GMT

Hi nike,

I have tried that - It worked for static fields, But it didn't work for Dynamic fields.
Any Suggestions for dynamics fields.

Thanks
RD

Re: Assign colour's based on the field value

niketn — Sat, 10 Mar 2018 17:04:19 GMT

Hi Unfortunately I think that would only be possible with jQuery. If your Splunk query ensures all series are always present (i.e. 0 instead of null) and also they are always in the same sequence, then you can use CSS Selector as well as the series number of your results will remain the same.