Splunk Search

Color a word in a field/Splunk Result

Path Finder

I have a Splunk query:


index=my_index cf_app_name=$app_name$ msg!="*Hikari*" $log_type$ | sort -_time | table msg


It populates Splunk with results. 

Now, the msg field has log_type as INFO, ERROR, WARNING. Example:


2021-11-17 15:03:34.921  INFO 22 --- [ taskExecutor-1] c.c.p.r.e.EventService            : Event sent to event ID: 2111 - REPRICING has finished

2021-11-16 22:23:54.905 ERROR 22 --- [ taskExecutor-1] c.c.p.r.service.SftpService           : Could not delete file: /-/PCS.P.KSZ4750J.TRIG.FILE - 4: Failure

2021-11-16 22:23:54.905 WARNING 22 --- [ taskExecutor-1] c.c.p.r.service.SftpService           : Could not delete file: /-/PCS.P.KSZ4750J.TRIG.FILE - 4: Failure


Now, My goals is to COLOR the log_type field in the "msg" to Green if it's INFO, Red if it's ERROR, and Yellow if it's WARNING. 

I don't want to color the entire msg field, just the words INFO, ERROR and WARNING should be turned to those specific colors. 

@scelikok @somesoni2 

Labels (4)
Tags (1)
0 Karma


Assuming you are using the standard table viz, this is not possible; you would need to split the message up into different fields and then just colour the field with the log type in.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...