You can always set explicit mapping for your charting series like so: <option name="charting.fieldColors"> {"field_kum":0xFF0000,"field_sum":0x0000FF} </option> That will always set field_kum to red and field_sum to blue ... View more

Your text is extremely difficult to understand but maybe this is what you seek: ... | timechart span=1m count by type ... View more

thank you for woodcock and for somesoni2, answer is OK, it works. ... View more

we are near by our problem, but not solved. in our record we have eventtime : 12:36:13, but Splunk eventtime showed for the same record is 00:36:13. And that's by all events between 12:00 and 13:00 hours in all days. App is "DB Connect v2" Anybody an idea ? ... View more

I do not understand (your language is hard to follow). You should probably create a new question and start over and try to spell out ALL of the details. ... View more