Dashboards & Visualizations
Highlighted

How to assign colors to events by eventtype?

Motivator

At splunk .conf2013 in one of the very last sessions a senior support guy showed how you can assign coloring to highlight events in eventview depending on their eventtype. I can not find the video of the session or any information of how he did it. There is more then one way of coloring custom views and all but i really really remember it being in the normal event view and i recall seeing that in splunk 6 it would now color the block in front of the event display plus some gui to configure it when creating a eventtype...

Anyone else recalls how this is done?

Tags (2)
0 Karma
Highlighted

Re: How to assign colors to events by eventtype?

Motivator

Silly me, it is available on the save as eventtype dialog. It is exposed in splunk 6 directly in this dialoge.

View solution in original post

Highlighted

Re: How to assign colors to events by eventtype?

Builder

I have been trying to use this, but regardless of what color I assign, they are never returned in that color. All events are black regardless of even type color assignment.

0 Karma
Highlighted

Re: How to assign colors to events by eventtype?

Motivator

The coloring uses a referal in stylesheet in $SPLUNK/etc/system/local/event_renderers.conf those are css elements in $SPLUNK/etc/apps/search/appserver/static/application.css and just use the predefined ones:

classes used by eventtype renderer

.splEvent-etblue .t { color:#00F; }
.splEvent-et
green .t { color:#0C0; }
.splEvent-etmagenta .t { color:#F09; }
.splEvent-et
orange .t { color:#F30; }
.splEvent-etpurple .t { color:#90C; }
.splEvent-et
red .t { color:#F00; }
.splEvent-etsky .t { color:#09F; }
.splEvent-et
teal .t { color:#099; }
.splEvent-et_yellow .t { color:#990; }

0 Karma
Highlighted

Re: How to assign colors to events by eventtype?

Path Finder

Although it isn't in the eventtype settings page- which is bizarre. How do you add colours to eventtypes defined manually?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.