Splunk Search

Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery
Communicator

Hi

I have a timechart with several lines, and I want to set the colors as in charting.fieldColors. However, the field names are dynamic, so I would need to use a regular expression or wildcard in the key; something like this:

<option name="charting.fieldColors">{ "PREVIEW":0x990000, "TASK_*":0x99CCFF } </option>

This there anything like this currently possible?

Thank you
John

lguinn2
Legend

Maybe you can do it this way. charting.seriesColors assigns the first color in the list to the first field in the results table, the second color to the second field, etc.

 <option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f]</option>

BTW, my example uses the first 5 default color values.

0 Karma

johnraftery
Communicator

Thanks for the suggesion. Unfortunately this won't solve the problem, because there could be any number of fields matching the "TASK_*" regex. So I would need to have 0x99CCFF in the list 100 times, and even then it might not catch all of them.

0 Karma

lguinn2
Legend

Keep in mind that the timechart command, by default, only shows the "top" 10 fields by default, so it is unlikely that you would need to list 100 fields. And if you are listing 100 fields, how can you read that? Perhaps you should consider some form of grouping prior to charting.

0 Karma

johnraftery
Communicator

If anyone knows of an alternative way of assigning color to fields to achieve this, please let me know.

0 Karma

lguinn2
Legend

I don't think so, but try it and see if it works... and let us know!

0 Karma

johnraftery
Communicator

I haven't been successful so far.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I'd try some quoting & escape character to see, but I believe lguinn has the correct answer.

"Task*"
"Task\.*"
"Task%"
'"Task*"'   
0 Karma

johnraftery
Communicator

Thanks...no luck unfortunately.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting V2

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...