Splunk Search

Why is the information column turning red at search time?

rbechtold
Communicator

While doing a basic raw search, I came across something I've never seen in Splunk -- the information column is turning red for certain logs before working with the data at all.

The only significant things about the logs that have the red highlighting is that they have an "error" tag, which I'm assuming is the reason why this is happening. I just didn't know highlighting logs before in the raw format was even possible.

If anyone has any idea what's causing this, or how to replicate this, I would be very interested.

alt text

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

These are known as event type renderers and it’s coloring events based on their eventtype.

You can configure them via UI or via conf file

https://answers.splunk.com/answers/492197/how-to-enable-event-type-coloring.html

View solution in original post

jkat54
SplunkTrust
SplunkTrust

These are known as event type renderers and it’s coloring events based on their eventtype.

You can configure them via UI or via conf file

https://answers.splunk.com/answers/492197/how-to-enable-event-type-coloring.html

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!