Splunk Search

change color of column chart for each type?

vrmandadi
Builder

alt textHello all ,

I ran the below query

....| chart count by SRC_ID

which gives me the count for each SRC_ID . when the visualized it in a column chart each id should have a different color

example

: SRC_ID COUNT

G 40
N 20

each id should have a color.I tried using the below XML but it did not change
option name="charting.fieldColors">{"G":0xFF0000,"N":0x6699FF}`

Tags (3)
0 Karma

chimell
Motivator

Hi
Test the following xml code

<dashboard>
  <label>my_title</label>
  <row>
   <panel>
<chart>
<title>Field colors example</title>
<search>
<query>
................................................ | chart count(eval(SRC_ID="G")) as ER   count(eval(SRC_ID="N")) as WA    count(eval(SRC_ID="U")) as INF  by  SRC_ID
</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="charting.axisY.scale">log</option>
<option name="charting.chart">column</option>
<option name="charting.fieldColors">
{"G": 0xFF0000, "N": 0xFF9900,"U": 0xFFAAF0}
</option>
<option name="charting.legend.placement">right</option>
</chart>
</panel>
  </row>
</dashboard>
0 Karma

somesoni2
Revered Legend

Try something like this

your base search | eval temp=1 | chart count over by SRC_ID limit=0 | rename temp as SRC_ID

The color code is assigned based of different series, your original search just have one series count. Above search will give series for each SRC_ID value so each will have different color

*Update *
To retain the x-axis labels, try this

your base search | chart count by SRC_ID | eval series=SRC_ID | chart values(count) over SRC_ID by series limit=0
0 Karma

vrmandadi
Builder

well the color is changing but it messed up with the SRC_ID ,it is not showing the name of each id in the x-axis and its showing both ids count when hover on the bar

0 Karma

vrmandadi
Builder

I tried the updated query

| chart count by SRC_ID | eval series=SRC_ID | chart values(count) over SRC_ID by series limit=0

the output is

SRC_ID G N U

G 40
N 20

U 10

0 Karma

vrmandadi
Builder

I have attached a screen shot to the question

0 Karma

menonmanish
Path Finder

You will get different colors for each SRC_ID for a different visualization like PIE. Why are you expecting column chart to have different colors..its not a normal behavior? Is that a requirement?

0 Karma

vrmandadi
Builder

ya that is why i am trying to figure out can it be done or not

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...