Dashboards & Visualizations

Timechart Help required

sathish2k8
Explorer

Folks,

I am doing log file monitoring, using this

index=os host="" "" | timechart count

I want the chart to display red color whenever there is ERROR and Yellow color whenever there is a Warning. Please guide me.

0 Karma
1 Solution

cmerriman
Super Champion

you're going to need to adjust your search to include the INFORM/ERROR/WARNING

index=os host="" "" |rex field=_raw "(?<status>.*)----"| timechart count by status

if you are on a newer version of Splunk (6.6+), you can highlight the values of status using the formatting options in the table.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/TableFormatsFormatting#Column_color

View solution in original post

cmerriman
Super Champion

you're going to need to adjust your search to include the INFORM/ERROR/WARNING

index=os host="" "" |rex field=_raw "(?<status>.*)----"| timechart count by status

if you are on a newer version of Splunk (6.6+), you can highlight the values of status using the formatting options in the table.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/TableFormatsFormatting#Column_color

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...