Splunk Search

Chart Color Assignment (seriesColors) Not Working Properly

David
Splunk Employee
Splunk Employee

This is the first time I've tried this, so I'm not sure if I've got something wrong. I'm trying to assign static colors to a large number of similar charts on a dashboard. I have in my config:

<param name="charting.legend.labels">[FieldA,FieldB,"Field C",FieldD,FieldE,FieldF,"Field G"]</param>
<param name="charting.seriesColors">[0x00FF00,0xFF0000,0x0000FF,0xFFFF00,0xFF00FF,0x00FFFF,0x000000]</param>

(ugly colors chosen as they're easy to recognize). I've verified that if I switch "Field C" and FieldD, they switch in the legend. The problem I'm seeing is that FieldD is green, FieldE is Red, FieldF is Blue, etc. It appears that instead of starting with FieldA=0x00FF00 and moving down the list, it's offsetting so that FieldD=0x00FF00 and then it moves down the list in order.

There's an obvious workaround (just rotate the colors around), but I'm curious as to whether this is a bug or some config issue on my part.

(Example based around: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedCharting)

Tags (1)
1 Solution

jgatt
Splunk Employee
Splunk Employee

There is one more parameter required to make this work when you have multiple charts on a page - setting the legend.masterLegend property to null or empty string:

<param name="charting.legend.masterLegend"></param>

This is discussed near the end of the "Chart colors" section. All legends for all charts in a view are connected to a common "master legend" so that their colors are synchronized. To ensure that your labels align with your colors, you need to detach the legend from the master legend.

Also, if you're using a version of Splunk below 4.2, the quotes you have around Field C and Field G will be interpreted as part of the label name. If that's not your intention, removing the quotes will give you the desired behavior.

Now, if you are using 4.2+, you can disregard all of this because, in addition to supporting quotes, spaces, etc. in complex values, mapping colors to field names is a whole lot easier:

<param name="charting.fieldColors">{ "FieldA": 0x00FF00, "FieldB": 0xFF0000 }</param>

This new feature (and other charting improvements in 4.2) is still in the process of being documented.

View solution in original post

jgatt
Splunk Employee
Splunk Employee

There is one more parameter required to make this work when you have multiple charts on a page - setting the legend.masterLegend property to null or empty string:

<param name="charting.legend.masterLegend"></param>

This is discussed near the end of the "Chart colors" section. All legends for all charts in a view are connected to a common "master legend" so that their colors are synchronized. To ensure that your labels align with your colors, you need to detach the legend from the master legend.

Also, if you're using a version of Splunk below 4.2, the quotes you have around Field C and Field G will be interpreted as part of the label name. If that's not your intention, removing the quotes will give you the desired behavior.

Now, if you are using 4.2+, you can disregard all of this because, in addition to supporting quotes, spaces, etc. in complex values, mapping colors to field names is a whole lot easier:

<param name="charting.fieldColors">{ "FieldA": 0x00FF00, "FieldB": 0xFF0000 }</param>

This new feature (and other charting improvements in 4.2) is still in the process of being documented.

sandipan11
Path Finder

Thank you for you answer. It is working. but I have another problem. When I have space in legend name like [US(%),Europe(%),Latin America(%)] but it creating 5 labels - US(%),Europe(%),Latin, America(%), Latin America(%). I guess it is happen for space in 'Latin America'. Is there any solution for this?

0 Karma

sandipan11
Path Finder

I got the solution. I keep each entry in double quote like ["US(%)","Europe(%)","Latin America(%)"]

0 Karma

0waste_splunk
Communicator

FYI: charting.fieldColors doesn't work on pie chart using JSChart.

0 Karma

David
Splunk Employee
Splunk Employee

Excellent -- that's good to know, and thanks for pointing out the part about charting.legend.masterLegend that I'd missed in the documentation.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...