Splunk Search

charting.fieldColors option doesn't seem to work when fields have a colon in the name?

johnraftery
Communicator

Hi,

I have a graph which is produced by this timechart command:

timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation

This produces fields:
"TPS_MAX: PREVIEW", "TPS_MAX: COMMIT", "TPS_MAX: CHECK_AND_RESERVE", "TPS_MAX: CHECK", "TPS_MAX: RESERVE", "ParNew: MLC_GC", "CMS: MLC_GC", "FULL_GC: MLC_GC"

I need to assign a specific color to each field, like this:

<option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option>

However, the colors are not displayed. Does the colon in the field name break the field colors option?

Thanks!
John

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma

jeffmartin
Engager

fieldColors gets confused by the ":" in your field names.  You need to escape the ":" in your field names in the fieldColors using a "\", like this:

  • <option name="charting.fieldColors">{"TPS_MAX\: PREVIEW":0x990000, "TPS_MAX\: COMMIT":0x999900, "TPS_MAX\: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX\: CHECK":0x9900FF, "TPS_MAX\: RESERVE":0x006600, "ParNew\: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC\: MLC_GC":0xff0000 }</option>
0 Karma

mclane1
Path Finder

2 ideas

  • Without spaces after coma.

    <option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000,"TPS_MAX: COMMIT":0x999900,"TPS_MAX: CHECK_AND_RESERVE":0x99CCFF,"TPS_MAX: CHECK":0x9900FF,"TPS_MAX: RESERVE":0x006600,"ParNew: MLC_GC":0x3333ff,"CMS: MLC_GC":0x009933,"FULL_GC: MLC_GC":0xff0000}</option>

  • Without spaces in fields
    You must change your query.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

0 Karma

johnraftery
Communicator

Thanks for that answer.

0 Karma

johnraftery
Communicator

Anyone have an answer?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...