Splunk Search

Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery
Communicator

Hi

I have a timechart with several lines, and I want to set the colors as in charting.fieldColors. However, the field names are dynamic, so I would need to use a regular expression or wildcard in the key; something like this:

<option name="charting.fieldColors">{ "PREVIEW":0x990000, "TASK_*":0x99CCFF } </option>

This there anything like this currently possible?

Thank you
John

lguinn2
Legend

Maybe you can do it this way. charting.seriesColors assigns the first color in the list to the first field in the results table, the second color to the second field, etc.

 <option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f]</option>

BTW, my example uses the first 5 default color values.

0 Karma

johnraftery
Communicator

Thanks for the suggesion. Unfortunately this won't solve the problem, because there could be any number of fields matching the "TASK_*" regex. So I would need to have 0x99CCFF in the list 100 times, and even then it might not catch all of them.

0 Karma

lguinn2
Legend

Keep in mind that the timechart command, by default, only shows the "top" 10 fields by default, so it is unlikely that you would need to list 100 fields. And if you are listing 100 fields, how can you read that? Perhaps you should consider some form of grouping prior to charting.

0 Karma

johnraftery
Communicator

If anyone knows of an alternative way of assigning color to fields to achieve this, please let me know.

0 Karma

lguinn2
Legend

I don't think so, but try it and see if it works... and let us know!

0 Karma

johnraftery
Communicator

I haven't been successful so far.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I'd try some quoting & escape character to see, but I believe lguinn has the correct answer.

"Task*"
"Task\.*"
"Task%"
'"Task*"'   
0 Karma

johnraftery
Communicator

Thanks...no luck unfortunately.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...