根据 Splunk 仪表板中的作业状态更改条形图中的条形颜色

Question

根据工作状态更改条形图中的条形颜色。

我收到以下消息：

Job XYZ Finished in 275 seconds
Job XYZ Finished with errors in 454 seconds
Job XYZ Finished in 473 seconds

我尝试了不同的方法，但没有成功，有人可以帮忙吗？谢谢

index=stg_index "Job Finished in" OR "Job Finished with errors in" | rex "in (?<Num>[^\s]+) seconds" | timechart values(Num) as ExecutionTime span=60min | sort _time

Answer 1

我们需要将工作状态分成不同的系列（例如

failed

和

ok

）。这是一个基于您的初始搜索的随处运行示例：

| makeresults
| eval sample = "Job XYZ Finished in 275 seconds|Job XYZ Finished with errors in 454 seconds|Job XYZ Finished in 473 seconds"
| makemv sample delim="|"
| mvexpand sample
| eval _time = _time - random() / 100000
| rename sample as _raw
| rex "in (?<exec_time>[^\s]+) seconds"
| rex "Finished with (?<status>error)"
| fillnull value="ok" status
| timechart span=60min max(exec_time) as ExecutionTime by status
| sort _time

这是您最初搜索的具体改编：

index=stg_index "Job Finished in" OR "Job Finished with errors in"
| rex "in (?<Num>[^\s]+) seconds"
| rex "Finished with (?<status>error)"
| fillnull value="ok" status
| timechart span=60min values(Num) as ExecutionTime by status
| sort _time

默认情况下，Splunk 会给每个系列不同的颜色。如果您特别希望它是红色的，那么您需要将搜索保存在仪表板中。要将特定颜色添加到简单的 XML 仪表板，您可以将以下标记添加到 XML，这是一个红色和绿色的示例：

<option name="charting.fieldColors">{"failed":#FF0000,"ok":#007840}</option>