Dashboards & Visualizations

How to assign colors to events by eventtype?

dominiquevocat
Motivator

At splunk .conf2013 in one of the very last sessions a senior support guy showed how you can assign coloring to highlight events in eventview depending on their eventtype. I can not find the video of the session or any information of how he did it. There is more then one way of coloring custom views and all but i really really remember it being in the normal event view and i recall seeing that in splunk 6 it would now color the block in front of the event display plus some gui to configure it when creating a eventtype...

Anyone else recalls how this is done?

Tags (2)
0 Karma
1 Solution

dominiquevocat
Motivator

Silly me, it is available on the save as eventtype dialog. It is exposed in splunk 6 directly in this dialoge.

View solution in original post

dominiquevocat
Motivator

Silly me, it is available on the save as eventtype dialog. It is exposed in splunk 6 directly in this dialoge.

kyleharrison
Path Finder

Although it isn't in the eventtype settings page- which is bizarre. How do you add colours to eventtypes defined manually?

0 Karma

Cuyose
Builder

I have been trying to use this, but regardless of what color I assign, they are never returned in that color. All events are black regardless of even type color assignment.

0 Karma

dominiquevocat
Motivator

The coloring uses a referal in stylesheet in $SPLUNK/etc/system/local/event_renderers.conf those are css elements in $SPLUNK/etc/apps/search/appserver/static/application.css and just use the predefined ones:

classes used by eventtype renderer

.splEvent-et_blue .t { color:#00F; }
.splEvent-et_green .t { color:#0C0; }
.splEvent-et_magenta .t { color:#F09; }
.splEvent-et_orange .t { color:#F30; }
.splEvent-et_purple .t { color:#90C; }
.splEvent-et_red .t { color:#F00; }
.splEvent-et_sky .t { color:#09F; }
.splEvent-et_teal .t { color:#099; }
.splEvent-et_yellow .t { color:#990; }

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...