Splunk Search

Assign colour's based on the field value

ravidudala
Explorer

Hi Splunkers,

I have the below query

( (index=xxx sourcetype=xxx severity=xxx intelId=xxx ) ) | eval intelId = case(match(intelId ,"xxx"),"Test1",match(intelId ,"XX"),"Test2") | eval intelId = severity+":"+intelId | timechart usenull=f span=1d count by intelId

So this query gives me the information in a chart with serverity+ the field name, for example for INFO it will INFO: Test1.

I was trying to give colors to the column chart with the following condition

"{"ERROR:":0xcc0000,"FATAL:":0xff9900,"INFO:":0x339933,"DEBUG:":0x6699ff}"

My goal is to achieve color based on the severity - But the above option doesn't seem to work.

Any inputs on this are much appreciated.

Thanks | RD

Tags (1)
0 Karma
1 Solution

niketn
Legend

@ravidudala, Based on your query seems like you have Two series Test1 and Test2 and four SLAs i.e. ERROR FATAL INFO and DEBUG. You can define 8 field colors in this case:

 <option name="charting.fieldColors">{"ERROR:Test1": 0xFF0000, "FATAL:Test1": 0xFF9900 ,"INFO:Test1": 0xFF9900, "DEBUG:Test1":0x0066FF,"ERROR:Test2": 0xFF0000, "FATAL:Test2": 0xFF9900 ,"INFO:Test2": 0xFF9900, "DEBUG:Test2":0x0066FF}</option>

The charting.fieldColors option looks for complete field name as it is and does not support wildcard characters like asterisk *

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@ravidudala, Based on your query seems like you have Two series Test1 and Test2 and four SLAs i.e. ERROR FATAL INFO and DEBUG. You can define 8 field colors in this case:

 <option name="charting.fieldColors">{"ERROR:Test1": 0xFF0000, "FATAL:Test1": 0xFF9900 ,"INFO:Test1": 0xFF9900, "DEBUG:Test1":0x0066FF,"ERROR:Test2": 0xFF0000, "FATAL:Test2": 0xFF9900 ,"INFO:Test2": 0xFF9900, "DEBUG:Test2":0x0066FF}</option>

The charting.fieldColors option looks for complete field name as it is and does not support wildcard characters like asterisk *

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ravidudala
Explorer

Hi nike,

I have tried that - It worked for static fields, But it didn't work for Dynamic fields.
Any Suggestions for dynamics fields.

Thanks
RD

0 Karma

niketn
Legend

Hi Unfortunately I think that would only be possible with jQuery. If your Splunk query ensures all series are always present (i.e. 0 instead of null) and also they are always in the same sequence, then you can use CSS Selector as well as the series number of your results will remain the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

493669
Super Champion

try this:

<option name="charting.fieldColors">
          {"ERROR": 0xFF0000, "FATAL": 0xFF9900 ,"INFO": 0xFF9900, "DEBUG":0x0066FF}
</option>

Reference: https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/ChartConfigurationReference

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...