Dashboards & Visualizations

Dashboard with Stacked Chart Custom Field Colors

acehlis
Engager

I've created a dashboard with four separate stacked charts. Each stacked chart has four fields: FAILURE, WARNING, OTHER, SUCCESS. I've modified the XML of the dashboard using:

<option name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xFF00FF,"SUCCESS":0x00FF00}</option>

But these modifications don't make it into my dashboard charts. Am I missing something or doing something wrong? I've tried several different ways of doing this and nothing seems to change the colors of the fields. Thanks.

0 Karma

acehlis
Engager

Yeah, I was afraid of that. I had seen that post, but it looked like the fix was a global tweek. I was able to get it presented with the FlashChart module, however I'm not sure that will be the best option in the long run. We have iPads being deployed to leadership, more and more.

I'd also like to note that it wasn't easy to find all the modules required to make the FlashChart look like the JSChart. It would be a nice documentation feature to break out examples in both JSChart and FlashChart.

Here's my FlashChart example, in case anyone else is looking to do the same thing, but hopefully JSChart gets the functionality soon:


<?xml version='1.0' encoding='utf-8'?>
<view template="dashboard.html">
<label>FlashChart Module Dashboard Example</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1"
group="Work Week (7AM Monday through 5PM Friday)" autoRun="True">
<param name="search">
search source=foo sourcetype=bar eventtype=workweek_hours | timechart span=1w count(TYPE) by TYPE usenull=f fixedrange=f
</param>
<param name="earliest">-365d@d</param>
<param name="latest">@d</param>
<module name="ResultsHeader">
<param name="entityName">scanned</param>
<param name="entityLabel">Events</param>
<module name="HiddenChartFormatter">
<param name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xBE00FF,"ACTIVE_OR_SUCCESS":0x00FF00}</param>
<param name="charting.chart.stackMode">stacked</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.data">results</param>
<module name="FlashChart">
<param name="height">400px</param>
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</view>

tysonstewart
Path Finder

When charts switched from default Flash to JSChart, I think they lost the fieldColors ability.
Related question and documentation. If you're OK with your chart using Flash, just specify the FlashChart module for that chart.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...