Splunk Search

How can we change the color of column chart?

ID_SplunkUser
Path Finder

I want to color the column bars based on the Status value I'm getting, having trouble in doing that. Can anyone help me in this.
Here's my code:

<chart>
        <search>
          <query>index=home sourcetype=data | eval Status=substr(HEADER,-1) | Eval Status= if(Status=="C","Complete",if(Status=="S","Received",if(Status=="R","Response"," ")))| chart count as Count by Status</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">linear</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"Received":0xFF0000,"Response":0xFFFF00, "Complete":0x73A550}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.axisTitleX.text">Status</option>
        <option name="refresh.auto.interval">600</option>
        <option name="charting.chart.overlayFields">cumulative</option>
        <option name="charting.axisY.minimumNumber">0</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>        
        <option name="charting.axisTitleY.text">Count</option>
</chart>
0 Karma
1 Solution

sundareshr
Legend

Try changing your query to this

index=home sourcetype=data 
| eval Status=substr(HEADER,-1) 
| stats count by Status
| eval Complete=if(Status="C", count, 0)
| eval Received=if(Status="S", count, 0)
| eval Response=if(Status="R", count, 0)

View solution in original post

sundareshr
Legend

Try changing your query to this

index=home sourcetype=data 
| eval Status=substr(HEADER,-1) 
| stats count by Status
| eval Complete=if(Status="C", count, 0)
| eval Received=if(Status="S", count, 0)
| eval Response=if(Status="R", count, 0)

ID_SplunkUser
Path Finder

Thanks. That works.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...