Dashboards & Visualizations
Highlighted

How to assign colors to events by eventtype?

Motivator

At splunk .conf2013 in one of the very last sessions a senior support guy showed how you can assign coloring to highlight events in eventview depending on their eventtype. I can not find the video of the session or any information of how he did it. There is more then one way of coloring custom views and all but i really really remember it being in the normal event view and i recall seeing that in splunk 6 it would now color the block in front of the event display plus some gui to configure it when creating a eventtype...

Anyone else recalls how this is done?

Tags (2)
0 Karma
Highlighted

Re: How to assign colors to events by eventtype?

Motivator

Silly me, it is available on the save as eventtype dialog. It is exposed in splunk 6 directly in this dialoge.

View solution in original post

Highlighted

Re: How to assign colors to events by eventtype?

Builder

I have been trying to use this, but regardless of what color I assign, they are never returned in that color. All events are black regardless of even type color assignment.

0 Karma
Highlighted

Re: How to assign colors to events by eventtype?

Motivator

The coloring uses a referal in stylesheet in $SPLUNK/etc/system/local/event_renderers.conf those are css elements in $SPLUNK/etc/apps/search/appserver/static/application.css and just use the predefined ones:

classes used by eventtype renderer

.splEvent-etblue .t { color:#00F; }
.splEvent-et
green .t { color:#0C0; }
.splEvent-etmagenta .t { color:#F09; }
.splEvent-et
orange .t { color:#F30; }
.splEvent-etpurple .t { color:#90C; }
.splEvent-et
red .t { color:#F00; }
.splEvent-etsky .t { color:#09F; }
.splEvent-et
teal .t { color:#099; }
.splEvent-et_yellow .t { color:#990; }

0 Karma
Highlighted

Re: How to assign colors to events by eventtype?

Path Finder

Although it isn't in the eventtype settings page- which is bizarre. How do you add colours to eventtypes defined manually?

0 Karma