Dashboards & Visualizations

Timechart Help required



I am doing log file monitoring, using this

index=os host="" "" | timechart count

I want the chart to display red color whenever there is ERROR and Yellow color whenever there is a Warning. Please guide me.

0 Karma

Re: Timechart Help required

Super Champion

you're going to need to adjust your search to include the INFORM/ERROR/WARNING

index=os host="" "" |rex field=_raw "(?<status>.*)----"| timechart count by status

if you are on a newer version of Splunk (6.6+), you can highlight the values of status using the formatting options in the table.

View solution in original post