Splunk Search

charting.fieldColors option doesn't seem to work when fields have a colon in the name?

johnraftery
Communicator

Hi,

I have a graph which is produced by this timechart command:

timechart max(duration) as TPS_MAX, sum(par_new_duration) as ParNew, sum(cms_duration) as CMS, sum(full_gc_duration) as FULL_GC by operation

This produces fields:
"TPS_MAX: PREVIEW", "TPS_MAX: COMMIT", "TPS_MAX: CHECK_AND_RESERVE", "TPS_MAX: CHECK", "TPS_MAX: RESERVE", "ParNew: MLC_GC", "CMS: MLC_GC", "FULL_GC: MLC_GC"

I need to assign a specific color to each field, like this:

<option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000, "TPS_MAX: COMMIT":0x999900, "TPS_MAX: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX: CHECK":0x9900FF, "TPS_MAX: RESERVE":0x006600, "ParNew: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC: MLC_GC":0xff0000 }</option>

However, the colors are not displayed. Does the colon in the field name break the field colors option?

Thanks!
John

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

View solution in original post

0 Karma

jeffmartin
Engager

fieldColors gets confused by the ":" in your field names.  You need to escape the ":" in your field names in the fieldColors using a "\", like this:

  • <option name="charting.fieldColors">{"TPS_MAX\: PREVIEW":0x990000, "TPS_MAX\: COMMIT":0x999900, "TPS_MAX\: CHECK_AND_RESERVE":0x99CCFF, "TPS_MAX\: CHECK":0x9900FF, "TPS_MAX\: RESERVE":0x006600, "ParNew\: MLC_GC":0x3333ff, "CMS: MLC_GC":0x009933, "FULL_GC\: MLC_GC":0xff0000 }</option>
0 Karma

mclane1
Path Finder

2 ideas

  • Without spaces after coma.

    <option name="charting.fieldColors">{"TPS_MAX: PREVIEW":0x990000,"TPS_MAX: COMMIT":0x999900,"TPS_MAX: CHECK_AND_RESERVE":0x99CCFF,"TPS_MAX: CHECK":0x9900FF,"TPS_MAX: RESERVE":0x006600,"ParNew: MLC_GC":0x3333ff,"CMS: MLC_GC":0x009933,"FULL_GC: MLC_GC":0xff0000}</option>

  • Without spaces in fields
    You must change your query.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try putting the field names in single quotes as opposed to double quotes.

0 Karma

johnraftery
Communicator

Thanks for that answer.

0 Karma

johnraftery
Communicator

Anyone have an answer?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...