Splunk row coloring

Ayman Eltemmsahy

When viewing log rows in Splunk, it's sometimes difficult to quickly distinguish between the different values you need. For example, is this a log level info or error or warning? Is this a status code of 200 or 400? Can you spot the one error among the 100 log lines? This extension helps you distinguish them quickly by colouring the rows based on the configuration you provide. For example, if it's a log level error, it will be red, if it's a warning, it will be yellow and it will be green for info. That way, it will be very easy to detect the errors while scrolling without needing to read the text. This extension is best used with Splunk line expander extension as it works only when the line is expanded and that's what that extension does. By default, Splunk does not expand the lines. It comes with a predefined set of options and it's totally configurable, you can add or remove any option. These options are evaluated in order of input and it stops after the first match.