Splunk Search

How can we change the color of column chart?

ID_SplunkUser
Path Finder

I want to color the column bars based on the Status value I'm getting, having trouble in doing that. Can anyone help me in this.
Here's my code:

<chart>
        <search>
          <query>index=home sourcetype=data | eval Status=substr(HEADER,-1) | Eval Status= if(Status=="C","Complete",if(Status=="S","Received",if(Status=="R","Response"," ")))| chart count as Count by Status</query>
          <earliest>-30d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">90</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">linear</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"Received":0xFF0000,"Response":0xFFFF00, "Complete":0x73A550}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.axisTitleX.text">Status</option>
        <option name="refresh.auto.interval">600</option>
        <option name="charting.chart.overlayFields">cumulative</option>
        <option name="charting.axisY.minimumNumber">0</option>
        <option name="charting.chart.showDataLabels">all</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>        
        <option name="charting.axisTitleY.text">Count</option>
</chart>
0 Karma
1 Solution

sundareshr
Legend

Try changing your query to this

index=home sourcetype=data 
| eval Status=substr(HEADER,-1) 
| stats count by Status
| eval Complete=if(Status="C", count, 0)
| eval Received=if(Status="S", count, 0)
| eval Response=if(Status="R", count, 0)

View solution in original post

sundareshr
Legend

Try changing your query to this

index=home sourcetype=data 
| eval Status=substr(HEADER,-1) 
| stats count by Status
| eval Complete=if(Status="C", count, 0)
| eval Received=if(Status="S", count, 0)
| eval Response=if(Status="R", count, 0)

ID_SplunkUser
Path Finder

Thanks. That works.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...