Splunk Search

How to customize bar chart colors based on the values?

guimilare
Communicator

Hi Splunkers.

I've been trying for a while to customize a bar chart I have.
Here are the data I have:

range            count
<2000            4804
Up to 3000       201
Up to 4000        96
Up to 5000          49
Up to 6000        21
Up to 7000        21
>7000             141

On the graph, all bars are blue. I need the first value (<2000) to be Green, the value (>7000) to be Red and the other ones to be Yellow.

Do you guys have any idea how could I achieve this?

Thanks in advance.
Best Regards

cblanton
Communicator

I think that fact that your field values indicate a numerical range is causing unnecessary confusion. Does this work?

<option name="charting.fieldColors">{"<2000":#A6CE39,">7000:#ED1C24,"Up to 3000":#FFDA00,"Up to 4000":#FFDA00,"Up to 5000":#FFDA00,"Up to 6000":#FFDA00,"Up to 7000":#FFDA00 }</option>
0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I copied the title of your question into the search bar, to find:

1.) https://answers.splunk.com/answers/334434/how-to-display-certain-colors-in-a-graph-based-on.html
2.) https://answers.splunk.com/answers/200861/how-to-change-bar-colors-in-a-bar-chart-based-on-v.html
3.) https://answers.splunk.com/answers/145120/bar-chart-column-color-based-on-value.html
4.) https://answers.splunk.com/answers/7228/change-column-color-if-over-a-range.html

although I am sure there are many others...


Please look at this documentation.


Usually the tricky part is getting the ranges mapped to some values. Thankfully, this is pretty easy to do with a rangemap command.

| rangemap field=count green=0-1999 yellow=2000-7000 red=7000-15000

or with the case function:

| eval color_map = case(count>7000, "red", count>2000, "yellow", count>0, "green")

Then in your xml, you have to use the series colors in the dashboard XML referenced in the documentation above:

<option name="charting.fieldColors">
  {"red":0xFF0000,"yellow":0xFFFF00,"green":0x00FF00}
</option>

Of course replacing the hex values FFFF00 with the hues of your choice.

samhodgson
Path Finder

I have used the rangemap method above like this:

| rangemap field=Percent green=0-100 red=100-1500

This provides another field either red or green depending on the value however the chart colours are not affected. I have added the charting.fieldColors option in the XML but I cant get the colour on the bar to map to the field outputted by the rangemap command. This is driving me nuts, i've tried the eval method too to no avail. Any suggestions on where im might be going wrong here would be greatly appreciated.

0 Karma

evinasco
Communicator

Hi, could you solve this doubt ?, I need to do the same range with bar graph

0 Karma

guimilare
Communicator

Hi alijohnson.

Before posting my question I read several answers abaout this topic.
But all of them did not helped.

In the example you gave, the bar will be red, yellow or green based on the value of the filed "count".
However, what I really want is that the field value "<2000" (that will be on the X axis) have always the color Green, regardless the value of count.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...