Dashboards & Visualizations

Dashboard Chart Properties Not Working ?

cvajs
Contributor

v4.3.1 linux

i created a simple dashboard as below. however, when i try to add some colorizing charting options they do not seem to apply to the chart. bug, or am i doing something wrong? the 1st chart shows up as blue colums on black background with no text. also, when i edit the visualization via the web gui and choose one of the stacked column styles it wont stack the graph. why?

using properties from here
http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/CustomChartingConfig-FontColorBrushPalet...

also, i dont know how to post code sample here as this forum mucks up the chars, so i tries to escape some stuff but this forum then adds chars, very very annoying!

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Quik Firewall View</label>
  <row>
    <chart>
      <searchString>index=cisco_firewall | top error_code limit=5</searchString>
      <title>Top 5 Events in the last 1hr</title>
      <earliestTime>-1h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
      <option name="charting.fontSize">11</option>
      <option name="charting.fontColor">0xFFFFFF</option>
      <option name="charting.backgroundColor">0xFF0000</option>
      <option name="charting.foregroundColor">0x00FF00</option>
      <option name="charting.seriesColors">[0x6CB8CA,0xFAC61D,0xD85E3D,0x956E96,0xF7912C]</option>
    </chart>
    <chart>
      <searchString>index=cisco_firewall | top error_code limit=5</searchString>
      <title>Top 5 Events in the last 24hrs</title>
      <earliestTime>-24h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
    </chart>
  </row>
  <row>
    <table>
      <searchString>index=cisco_firewall earliest=-1h latest=now [search index=cisco_firewall | top error_code limit=5 | table error_code] | stats count(error_code) by error_code event_desc | dedup error_code | sort - count(error_code)</searchString>
      <title>Event Descriptions and Counts for above chart</title>
      <earliestTime>-1h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.backgroundColor">0xFFFFFF</option>
      <option name="charting.fontColor">0xFF0000</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
    </table>
    <table>
      <searchString>index=cisco_firewall earliest=-24h latest=now [search index=cisco_firewall | top error_code limit=5 | table error_code] | stats count(error_code) by error_code event_desc | dedup error_code | sort - count(error_code)</searchString>
      <title>Event Descriptions and Counts for above chart</title>
      <earliestTime>-24h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
    </table>
  </row>
 </dashboard>
0 Karma
1 Solution

Ayn
Legend

These options are unfortunately currently not supported in the Javascript charting module that is used. More information here: http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/AdvancedCharting

View solution in original post

Ayn
Legend

These options are unfortunately currently not supported in the Javascript charting module that is used. More information here: http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/AdvancedCharting

cvajs
Contributor

ah, ok. then i guess i need to used advanced XML with flash chart.

0 Karma

Ayn
Legend

Syntax is well documented here, and is linked in the text box when posting: http://daringfireball.net/projects/markdown/syntax

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...