Dashboards & Visualizations

How do you colorize event types, so the i column in the search results is colored?

alinadejeu
Explorer

I have an app I'm building that contains an event panel. I know splunk comes with event type colors which I can enable through the UI and it does work just fine. However, I would like to add additional colors. And I am having difficulties trying to figure out how to get it to work. I have found several different splunk communication questions around this and I think I'm close to getting it to work.

To my understanding I have to update 3 files (eventypes.conf, event_renderer.conf, and application.css)

Here is an example of what I have tried:

Eventtypes.conf

[bin_rm]
search = index=* sourcetype=*forensic* desc="*bin/rm*" OR short="*bin/rm*" tag=“deleted_data”

Event_Renderers.conf

[EventRenderer_bin_rm]
eventtype = bin_rm 
css_class = EventRendererdeleted_data

Application.css

.splEvent-EventRendererdeleted_data .event{ background-color: #000000; color: #ffffff}

For some reason this is not working, and I don't understand what I'm missing. I would like the > symbol under the i column to appear white with a black background when the eventtype matches.

Also where is the application.css file supposed to be? I currently have it under appserver/static/application.css

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...