Splunk Search
Highlighted

charting.fieldColors option doesn't seem to work when fields have a colon in the name?

Communicator

Hi,

I have a graph which is produced by this timechart command:

timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation

This produces fields:
"TPSMAX: PREVIEW", "TPSMAX: COMMIT", "TPSMAX: CHECKANDRESERVE", "TPSMAX: CHECK", "TPSMAX: RESERVE", "ParNew: MLCGC", "CMS: MLCGC", "FULLGC: MLC_GC"

I need to assign a specific color to each field, like this:

<option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option>

However, the colors are not displayed. Does the colon in the field name break the field colors option?

Thanks!
John

0 Karma
Highlighted

Re: charting.fieldColors option doesn't seem to work when fields have a colon in the name?

Communicator

Anyone have an answer?

0 Karma
Highlighted

Re: charting.fieldColors option doesn't seem to work when fields have a colon in the name?

SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma
Highlighted

Re: charting.fieldColors option doesn't seem to work when fields have a colon in the name?

Communicator

Thanks for that answer.

0 Karma
Highlighted

Re: charting.fieldColors option doesn't seem to work when fields have a colon in the name?

Path Finder

2 ideas

  • Without spaces after coma.

    <option name="charting.fieldColors">{"TPSMAX: PREVIEW":0x990000,"TPSMAX: COMMIT":0x999900,"TPSMAX: CHECKANDRESERVE":0x99CCFF,"TPSMAX: CHECK":0x9900FF,"TPSMAX: RESERVE":0x006600,"ParNew: MLCGC":0x3333ff,"CMS: MLCGC":0x009933,"FULLGC: MLC_GC":0xff0000}</option>

  • Without spaces in fields
    You must change your query.

0 Karma