Splunk: Unterschiedliche Farbe auf einem Balken

Question

In meiner Anwendung versuche ich Anzeige Logs von Logger.
meine Quelle Struktur So:

Application - Anwendungsname
Interface - Logger Name
Level - Protokollebene

Meine Suchkriterien:

index="log_index" sourcetype=log_source 
| eval logger = Application + ":" + Interface + " - " + Level 
| eval error= if(Level == "Error", 1, 0) 
| eval warn= if(Level == "Warn", 1, 0) 
| eval info= if(Level == "Info", 1, 0) 
| eval fatal= if(Level == "Fatal", 1, 0) 
| search fatal=1 OR error=1 OR warn=1 OR info=0 
| stats count(Level) by logger sort by count(Level) desc 

ich meine Optionen :

<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> 
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> 
<option name="charting.axisTitleX.visibility">visible</option> 
<option name="charting.axisTitleY.visibility">visible</option> 
<option name="charting.axisTitleY2.text">title</option> 
<option name="charting.axisTitleY2.visibility">visible</option> 
<option name="charting.axisX.scale">linear</option> 
<option name="charting.axisY.scale">linear</option> 
<option name="charting.axisY2.enabled">0</option> 
<option name="charting.axisY2.scale">inherit</option> 
<option name="charting.chart">bar</option> 
<option name="charting.chart.bubbleMaximumSize">500</option> 
<option name="charting.chart.bubbleMinimumSize">10</option> 
<option name="charting.chart.bubbleSizeBy">area</option> 
<option name="charting.chart.nullValueMode">gaps</option> 
<option name="charting.chart.showDataLabels">minmax</option> 
<option name="charting.chart.sliceCollapsingThreshold">0.01</option> 
<option name="charting.chart.stackMode">default</option> 
<option name="charting.chart.style">shiny</option> 
<option name="charting.drilldown">all</option> 
<option name="charting.layout.splitSeries">1</option> 
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> 
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> 
<option name="charting.legend.placement">right</option> 
<option name="charting.chart">column</option> 
<option name="charting.chart.stackMode">stacked</option> 
<option name="charting.fieldColors">{"error":0xFF0000,"warn":0xFFFF00, "info":0x73A550, "fatal": 0x000000}</option> 
<option name="charting.seriesColors">[0xFF0000,0xFFFF00,0x00FF00, 0x000000]</option> 

Mein Ziel: Ich möchte Balkenfarbe auf Ebene für jeden Logger (Anwendung plus Schnittstelle plus Ebene) anpassen. So Bar mit level fatal sollte rot sein, Fehler schwarz etc usw.

Ich hoffe, dass jemand von Ihnen wird wissen, wie dieses Tool zu konfigurieren.

Answer 1

komplexe Lösung:

splunk answer
by somesoni2 from splunk answer

kopierten Inhalt:

index="log_index" sourcetype=log_source 
Level="Error" OR Level="Warn" OR Level="Info" OR Level="Fatal" 
| eval logger = Application + ":" + Interface 
| chart count over logger by Level 
| addtotals 
| sort -Total 
| fields - Total