I am doing log file monitoring, using this
index=os host="" "" | timechart count
I want the chart to display red color whenever there is ERROR and Yellow color whenever there is a Warning. Please guide me.
you're going to need to adjust your search to include the INFORM/ERROR/WARNING
index=os host="" "" |rex field=_raw "(?<status>.*)----"| timechart count by status
if you are on a newer version of Splunk (6.6+), you can highlight the values of status using the formatting options in the table.
View solution in original post