Splunk Search

Why is the information column turning red at search time?


While doing a basic raw search, I came across something I've never seen in Splunk -- the information column is turning red for certain logs before working with the data at all.

The only significant things about the logs that have the red highlighting is that they have an "error" tag, which I'm assuming is the reason why this is happening. I just didn't know highlighting logs before in the raw format was even possible.

If anyone has any idea what's causing this, or how to replicate this, I would be very interested.

alt text

0 Karma

Re: Why is the information column turning red at search time?


These are known as event type renderers and it’s coloring events based on their eventtype.

You can configure them via UI or via conf file


View solution in original post

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.