Splunk Search

Color appended search results?

dondky
Path Finder

All,

Is it possible to assign your appended search a separate color so it's easier to spot appended events in the timeline view?

eventtype=opsec_drop 127.0.0.1 tcp_flags="PUSH-ACK" | append [search sourcetype=access_combined source="/var/log/httpd/example_*"]

The thought is that it would allow us to quickly narrow down exactly where two events occurred.

Thanks

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Define eventtypes for each, do one search (no subsearch append stuff) like this:

eventtype=type_one OR eventtype=type_two

and configure your two eventtypes with different colours.

martin_mueller
SplunkTrust
SplunkTrust

The colours appear in the displayed raw events.

0 Karma

dondky
Path Finder

Thanks, to be clear this is to customize the timeline display during a search correct?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...