Splunk Search

charting.fieldColors option doesn't seem to work when fields have a colon in the name?

johnraftery
Communicator

Hi,

I have a graph which is produced by this timechart command:

timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation

This produces fields:
"TPS_MAX: PREVIEW", "TPS_MAX: COMMIT", "TPS_MAX: CHECK_AND_RESERVE", "TPS_MAX: CHECK", "TPS_MAX: RESERVE", "ParNew: MLC_GC", "CMS: MLC_GC", "FULL_GC: MLC_GC"

I need to assign a specific color to each field, like this:

<option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option>

However, the colors are not displayed. Does the colon in the field name break the field colors option?

Thanks!
John

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma

jeffmartin
Engager

fieldColors gets confused by the ":" in your field names.  You need to escape the ":" in your field names in the fieldColors using a "\", like this:

  • <option name="charting.fieldColors">{"TPS_MAX\: PREVIEW":0x990000, "TPS_MAX\: COMMIT":0x999900, "TPS_MAX\: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX\: CHECK":0x9900FF, "TPS_MAX\: RESERVE":0x006600, "ParNew\: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC\: MLC_GC":0xff0000 }</option>
0 Karma

mclane1
Path Finder

2 ideas

  • Without spaces after coma.

    <option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000,"TPS_MAX: COMMIT":0x999900,"TPS_MAX: CHECK_AND_RESERVE":0x99CCFF,"TPS_MAX: CHECK":0x9900FF,"TPS_MAX: RESERVE":0x006600,"ParNew: MLC_GC":0x3333ff,"CMS: MLC_GC":0x009933,"FULL_GC: MLC_GC":0xff0000}</option>

  • Without spaces in fields
    You must change your query.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

0 Karma

johnraftery
Communicator

Thanks for that answer.

0 Karma

johnraftery
Communicator

Anyone have an answer?

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...