Splunk Search

charting.fieldColors option doesn't seem to work when fields have a colon in the name?

johnraftery
Communicator

Hi,

I have a graph which is produced by this timechart command:

timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation

This produces fields:
"TPS_MAX: PREVIEW", "TPS_MAX: COMMIT", "TPS_MAX: CHECK_AND_RESERVE", "TPS_MAX: CHECK", "TPS_MAX: RESERVE", "ParNew: MLC_GC", "CMS: MLC_GC", "FULL_GC: MLC_GC"

I need to assign a specific color to each field, like this:

<option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option>

However, the colors are not displayed. Does the colon in the field name break the field colors option?

Thanks!
John

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma

mclane1
Path Finder

2 ideas

  • Without spaces after coma.

    <option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000,"TPS_MAX: COMMIT":0x999900,"TPS_MAX: CHECK_AND_RESERVE":0x99CCFF,"TPS_MAX: CHECK":0x9900FF,"TPS_MAX: RESERVE":0x006600,"ParNew: MLC_GC":0x3333ff,"CMS: MLC_GC":0x009933,"FULL_GC: MLC_GC":0xff0000}</option>

  • Without spaces in fields
    You must change your query.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma

johnraftery
Communicator

Thanks for that answer.

0 Karma

johnraftery
Communicator

Anyone have an answer?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.