Splunk Search

Can I use a regular expression or wildcard inside charting.fieldColors?

johnraftery
Communicator

Hi

I have a timechart with several lines, and I want to set the colors as in charting.fieldColors. However, the field names are dynamic, so I would need to use a regular expression or wildcard in the key; something like this:

<option name="charting.fieldColors">{ "PREVIEW":0x990000, "TASK_*":0x99CCFF } </option>

This there anything like this currently possible?

Thank you
John

lguinn2
Legend

Maybe you can do it this way. charting.seriesColors assigns the first color in the list to the first field in the results table, the second color to the second field, etc.

 <option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f]</option>

BTW, my example uses the first 5 default color values.

0 Karma

johnraftery
Communicator

Thanks for the suggesion. Unfortunately this won't solve the problem, because there could be any number of fields matching the "TASK_*" regex. So I would need to have 0x99CCFF in the list 100 times, and even then it might not catch all of them.

0 Karma

lguinn2
Legend

Keep in mind that the timechart command, by default, only shows the "top" 10 fields by default, so it is unlikely that you would need to list 100 fields. And if you are listing 100 fields, how can you read that? Perhaps you should consider some form of grouping prior to charting.

0 Karma

johnraftery
Communicator

If anyone knows of an alternative way of assigning color to fields to achieve this, please let me know.

0 Karma

lguinn2
Legend

I don't think so, but try it and see if it works... and let us know!

0 Karma

johnraftery
Communicator

I haven't been successful so far.

0 Karma

jkat54
SplunkTrust
SplunkTrust

I'd try some quoting & escape character to see, but I believe lguinn has the correct answer.

"Task*"
"Task\.*"
"Task%"
'"Task*"'   
0 Karma

johnraftery
Communicator

Thanks...no luck unfortunately.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...