At splunk .conf2013 in one of the very last sessions a senior support guy showed how you can assign coloring to highlight events in eventview depending on their eventtype. I can not find the video of the session or any information of how he did it. There is more then one way of coloring custom views and all but i really really remember it being in the normal event view and i recall seeing that in splunk 6 it would now color the block in front of the event display plus some gui to configure it when creating a eventtype...
Anyone else recalls how this is done?
Silly me, it is available on the save as eventtype dialog. It is exposed in splunk 6 directly in this dialoge.
Silly me, it is available on the save as eventtype dialog. It is exposed in splunk 6 directly in this dialoge.
Although it isn't in the eventtype settings page- which is bizarre. How do you add colours to eventtypes defined manually?
I have been trying to use this, but regardless of what color I assign, they are never returned in that color. All events are black regardless of even type color assignment.
The coloring uses a referal in stylesheet in $SPLUNK/etc/system/local/event_renderers.conf those are css elements in $SPLUNK/etc/apps/search/appserver/static/application.css and just use the predefined ones:
.splEvent-et_blue .t { color:#00F; }
.splEvent-et_green .t { color:#0C0; }
.splEvent-et_magenta .t { color:#F09; }
.splEvent-et_orange .t { color:#F30; }
.splEvent-et_purple .t { color:#90C; }
.splEvent-et_red .t { color:#F00; }
.splEvent-et_sky .t { color:#09F; }
.splEvent-et_teal .t { color:#099; }
.splEvent-et_yellow .t { color:#990; }