Assign colour's based on the field value

[ravidudala]

Hi Splunkers,

I have the below query

( (index=xxx sourcetype=xxx severity=xxx intelId=xxx ) ) | eval intelId = case(match(intelId ,"xxx"),"Test1",match(intelId ,"XX"),"Test2") | eval intelId = severity+":"+intelId | timechart usenull=f span=1d count by intelId

So this query gives me the information in a chart with serverity+ the field name, for example for INFO it will INFO: Test1.

I was trying to give colors to the column chart with the following condition

"{"ERROR:":0xcc0000,"FATAL:":0xff9900,"INFO:":0x339933,"DEBUG:":0x6699ff}"

My goal is to achieve color based on the severity - But the above option doesn't seem to work.

Any inputs on this are much appreciated.

Thanks | RD

[niketn · Accepted solution]

@ravidudala, Based on your query seems like you have Two series Test1 and Test2 and four SLAs i.e. ERROR FATAL INFO and DEBUG. You can define 8 field colors in this case:

 <option name="charting.fieldColors">{"ERROR:Test1": 0xFF0000, "FATAL:Test1": 0xFF9900 ,"INFO:Test1": 0xFF9900, "DEBUG:Test1":0x0066FF,"ERROR:Test2": 0xFF0000, "FATAL:Test2": 0xFF9900 ,"INFO:Test2": 0xFF9900, "DEBUG:Test2":0x0066FF}</option>

The charting.fieldColors option looks for complete field name as it is and does not support wildcard characters like asterisk *

[ravidudala]

Hi nike,

I have tried that - It worked for static fields, But it didn't work for Dynamic fields.
Any Suggestions for dynamics fields.

Thanks
RD

[niketn]

Hi Unfortunately I think that would only be possible with jQuery. If your Splunk query ensures all series are always present (i.e. 0 instead of null) and also they are always in the same sequence, then you can use CSS Selector as well as the series number of your results will remain the same.

[493669]

try this:

<option name="charting.fieldColors">
          {"ERROR": 0xFF0000, "FATAL": 0xFF9900 ,"INFO": 0xFF9900, "DEBUG":0x0066FF}
</option>

Reference: https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/ChartConfigurationReference