Splunk Search

charting.fieldColors option doesn't seem to work when fields have a colon in the name?

johnraftery
Communicator

Hi,

I have a graph which is produced by this timechart command:

timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation

This produces fields:
"TPS_MAX: PREVIEW", "TPS_MAX: COMMIT", "TPS_MAX: CHECK_AND_RESERVE", "TPS_MAX: CHECK", "TPS_MAX: RESERVE", "ParNew: MLC_GC", "CMS: MLC_GC", "FULL_GC: MLC_GC"

I need to assign a specific color to each field, like this:

<option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option>

However, the colors are not displayed. Does the colon in the field name break the field colors option?

Thanks!
John

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma

jeffmartin
Engager

fieldColors gets confused by the ":" in your field names.  You need to escape the ":" in your field names in the fieldColors using a "\", like this:

  • <option name="charting.fieldColors">{"TPS_MAX\: PREVIEW":0x990000, "TPS_MAX\: COMMIT":0x999900, "TPS_MAX\: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX\: CHECK":0x9900FF, "TPS_MAX\: RESERVE":0x006600, "ParNew\: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC\: MLC_GC":0xff0000 }</option>
0 Karma

mclane1
Path Finder

2 ideas

  • Without spaces after coma.

    <option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000,"TPS_MAX: COMMIT":0x999900,"TPS_MAX: CHECK_AND_RESERVE":0x99CCFF,"TPS_MAX: CHECK":0x9900FF,"TPS_MAX: RESERVE":0x006600,"ParNew: MLC_GC":0x3333ff,"CMS: MLC_GC":0x009933,"FULL_GC: MLC_GC":0xff0000}</option>

  • Without spaces in fields
    You must change your query.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

0 Karma

johnraftery
Communicator

Thanks for that answer.

0 Karma

johnraftery
Communicator

Anyone have an answer?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...