v4.3.1 linux
i created a simple dashboard as below. however, when i try to add some colorizing charting options they do not seem to apply to the chart. bug, or am i doing something wrong? the 1st chart shows up as blue colums on black background with no text. also, when i edit the visualization via the web gui and choose one of the stacked column styles it wont stack the graph. why?
using properties from here
http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/CustomChartingConfig-FontColorBrushPalet...
also, i dont know how to post code sample here as this forum mucks up the chars, so i tries to escape some stuff but this forum then adds chars, very very annoying!
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>Quik Firewall View</label>
<row>
<chart>
<searchString>index=cisco_firewall | top error_code limit=5</searchString>
<title>Top 5 Events in the last 1hr</title>
<earliestTime>-1h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.primaryAxisTitle.text"/>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
<option name="drilldown">all</option>
<option name="charting.fontSize">11</option>
<option name="charting.fontColor">0xFFFFFF</option>
<option name="charting.backgroundColor">0xFF0000</option>
<option name="charting.foregroundColor">0x00FF00</option>
<option name="charting.seriesColors">[0x6CB8CA,0xFAC61D,0xD85E3D,0x956E96,0xF7912C]</option>
</chart>
<chart>
<searchString>index=cisco_firewall | top error_code limit=5</searchString>
<title>Top 5 Events in the last 24hrs</title>
<earliestTime>-24h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.primaryAxisTitle.text"/>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
<option name="drilldown">all</option>
</chart>
</row>
<row>
<table>
<searchString>index=cisco_firewall earliest=-1h latest=now [search index=cisco_firewall | top error_code limit=5 | table error_code] | stats count(error_code) by error_code event_desc | dedup error_code | sort - count(error_code)</searchString>
<title>Event Descriptions and Counts for above chart</title>
<earliestTime>-1h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.backgroundColor">0xFFFFFF</option>
<option name="charting.fontColor">0xFF0000</option>
<option name="charting.primaryAxisTitle.text"/>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
<option name="drilldown">all</option>
</table>
<table>
<searchString>index=cisco_firewall earliest=-24h latest=now [search index=cisco_firewall | top error_code limit=5 | table error_code] | stats count(error_code) by error_code event_desc | dedup error_code | sort - count(error_code)</searchString>
<title>Event Descriptions and Counts for above chart</title>
<earliestTime>-24h</earliestTime>
<latestTime>now</latestTime>
<option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.primaryAxisTitle.text"/>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
<option name="drilldown">all</option>
</table>
</row>
</dashboard>
These options are unfortunately currently not supported in the Javascript charting module that is used. More information here: http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/AdvancedCharting
These options are unfortunately currently not supported in the Javascript charting module that is used. More information here: http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/AdvancedCharting
ah, ok. then i guess i need to used advanced XML with flash chart.
Syntax is well documented here, and is linked in the text box when posting: http://daringfireball.net/projects/markdown/syntax