Dashboards & Visualizations

Timechart Help required

sathish2k8
Explorer

Folks,

I am doing log file monitoring, using this

index=os host="" "" | timechart count

I want the chart to display red color whenever there is ERROR and Yellow color whenever there is a Warning. Please guide me.

0 Karma
1 Solution

cmerriman
Super Champion

you're going to need to adjust your search to include the INFORM/ERROR/WARNING

index=os host="" "" |rex field=_raw "(?<status>.*)----"| timechart count by status

if you are on a newer version of Splunk (6.6+), you can highlight the values of status using the formatting options in the table.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/TableFormatsFormatting#Column_color

View solution in original post

cmerriman
Super Champion

you're going to need to adjust your search to include the INFORM/ERROR/WARNING

index=os host="" "" |rex field=_raw "(?<status>.*)----"| timechart count by status

if you are on a newer version of Splunk (6.6+), you can highlight the values of status using the formatting options in the table.
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Viz/TableFormatsFormatting#Column_color

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...