Dashboards & Visualizations

Dashboard with Stacked Chart Custom Field Colors

acehlis
Engager

I've created a dashboard with four separate stacked charts. Each stacked chart has four fields: FAILURE, WARNING, OTHER, SUCCESS. I've modified the XML of the dashboard using:

<option name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xFF00FF,"SUCCESS":0x00FF00}</option>

But these modifications don't make it into my dashboard charts. Am I missing something or doing something wrong? I've tried several different ways of doing this and nothing seems to change the colors of the fields. Thanks.

0 Karma

acehlis
Engager

Yeah, I was afraid of that. I had seen that post, but it looked like the fix was a global tweek. I was able to get it presented with the FlashChart module, however I'm not sure that will be the best option in the long run. We have iPads being deployed to leadership, more and more.

I'd also like to note that it wasn't easy to find all the modules required to make the FlashChart look like the JSChart. It would be a nice documentation feature to break out examples in both JSChart and FlashChart.

Here's my FlashChart example, in case anyone else is looking to do the same thing, but hopefully JSChart gets the functionality soon:


<?xml version='1.0' encoding='utf-8'?>
<view template="dashboard.html">
<label>FlashChart Module Dashboard Example</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1"
group="Work Week (7AM Monday through 5PM Friday)" autoRun="True">
<param name="search">
search source=foo sourcetype=bar eventtype=workweek_hours | timechart span=1w count(TYPE) by TYPE usenull=f fixedrange=f
</param>
<param name="earliest">-365d@d</param>
<param name="latest">@d</param>
<module name="ResultsHeader">
<param name="entityName">scanned</param>
<param name="entityLabel">Events</param>
<module name="HiddenChartFormatter">
<param name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xBE00FF,"ACTIVE_OR_SUCCESS":0x00FF00}</param>
<param name="charting.chart.stackMode">stacked</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.data">results</param>
<module name="FlashChart">
<param name="height">400px</param>
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</view>

tysonstewart
Path Finder

When charts switched from default Flash to JSChart, I think they lost the fieldColors ability.
Related question and documentation. If you're OK with your chart using Flash, just specify the FlashChart module for that chart.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...