topic Re: Can I use a regular expression or wildcard inside charting.fieldColors? in Splunk Search

Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery — Thu, 17 Dec 2015 17:04:18 GMT

I have a timechart with several lines, and I want to set the colors as in charting.fieldColors. However, the field names are dynamic, so I would need to use a regular expression or wildcard in the key; something like this:

<option name="charting.fieldColors">{ "PREVIEW":0x990000, "TASK_*":0x99CCFF } </option>

This there anything like this currently possible?

Thank you
John

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

lguinn2 — Thu, 17 Dec 2015 19:20:25 GMT

I don't think so, but try it and see if it works... and let us know!

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery — Fri, 18 Dec 2015 09:14:51 GMT

I haven't been successful so far.

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery — Fri, 18 Dec 2015 09:16:26 GMT

If anyone knows of an alternative way of assigning color to fields to achieve this, please let me know.

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

jkat54 — Fri, 18 Dec 2015 11:44:44 GMT

I'd try some quoting & escape character to see, but I believe lguinn has the correct answer.

"Task*"
"Task\.*"
"Task%"
'"Task*"'

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery — Fri, 18 Dec 2015 12:17:14 GMT

Thanks...no luck unfortunately.

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

lguinn2 — Fri, 18 Dec 2015 17:06:11 GMT

Maybe you can do it this way. charting.seriesColors assigns the first color in the list to the first field in the results table, the second color to the second field, etc.

 <option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f]</option>

BTW, my example uses the first 5 default color values.

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery — Mon, 21 Dec 2015 17:07:22 GMT

Thanks for the suggesion. Unfortunately this won't solve the problem, because there could be any number of fields matching the "TASK_*" regex. So I would need to have 0x99CCFF in the list 100 times, and even then it might not catch all of them.

Re: Can I use a regular expression or wildcard inside charting.fieldColors?

lguinn2 — Mon, 04 Jan 2016 06:39:02 GMT

Keep in mind that the timechart command, by default, only shows the "top" 10 fields by default, so it is unlikely that you would need to list 100 fields. And if you are listing 100 fields, how can you read that? Perhaps you should consider some form of grouping prior to charting.