All Apps and Add-ons

Using timeline visulations can i get the colors to be the same as a time chart graph for consistency

robertlynch2020
Motivator

Below is an image of my dashboard, I have multiple graphs been drawn and they all use the same colors automatically.
However when i add in a timeline i can only get blue, when i turn on the colors i get the second graphs, not very nice.

Is there any way to get timeline to take the colors that have been picked allready?

alt text

alt text

0 Karma
1 Solution

robertlynch2020
Motivator

Got this working with help from @niketnilay answer

eventtype=mlc sourcetype=tps host=TimeSeries | eval foo="ON" | eval foo1="true" | eval foo2="ON" | eval duration = endTime - startTime | search name = "" operationIdentity=* | eval fullyQualifiedMethod = name."#".operationIdentity |sort - duration | eval fullyQualifiedMethod2 = name."#".operationIdentity | table _time fullyQualifiedMethod fullyQualifiedMethod2 duration

View solution in original post

0 Karma

robertlynch2020
Motivator

Got this working with help from @niketnilay answer

eventtype=mlc sourcetype=tps host=TimeSeries | eval foo="ON" | eval foo1="true" | eval foo2="ON" | eval duration = endTime - startTime | search name = "" operationIdentity=* | eval fullyQualifiedMethod = name."#".operationIdentity |sort - duration | eval fullyQualifiedMethod2 = name."#".operationIdentity | table _time fullyQualifiedMethod fullyQualifiedMethod2 duration

0 Karma

niketn
Legend

Splunk Charts applies series colors to all charts. In fact if the series names are same, that is how all series will pick same color.

If you notice in your screenshot, when you choose Categorical colors for the Timeline visualization, the Legends in the same sequence have the same colors as compared to other charts i.e. First color in your timechart as well TimeLine visualization is blue(0x1e93c6) and second is orange(0xf2b827)... and so on.

Following are default series colors picked up by Splunk charts (charting.seriesColors😞
[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f, 0x11a88b, 0xea9600, 0x0e776d, 0xffb380, 0xaa3977, 0x91af27, 0x4453aa, 0x99712b, 0x553577, 0x97bc71, 0xd35c2d, 0x314d5b, 0x99962b, 0x844539, 0x00b290, 0xe2c188, 0xa34a41, 0x44416d, 0xe29847, 0x8c8910, 0x0b416d, 0x774772, 0x3d9988, 0xbdbd5e, 0x5f7396, 0x844539]

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

robertlynch2020
Motivator

Hi. Thanks for looking at this for me. I agree the colors are the same sequence in Categorical graph.

But this issue is they are changing over and over even do the series name is the same ( Lots of round circles). what i really would love is to have long blocks from the first image with the same colors.

So a user can look at the colors of a series in the pie and its the same in thr gantt.

0 Karma

robertlynch2020
Motivator

Hi, In fact by adding in an extra column this is now working.

eventtype=mlc sourcetype=tps host=TimeSeries | eval foo="ON" | eval foo1="true" | eval foo2="ON" | eval duration = endTime - startTime | search name = "" operationIdentity=* | eval fullyQualifiedMethod = name."#".operationIdentity |sort - duration | eval fullyQualifiedMethod2 = name."#".operationIdentity | table _time fullyQualifiedMethod fullyQualifiedMethod2 duration

0 Karma

niketn
Legend

@robertlynch2020 ... You can convert your previous comment as an answer and vote the same. However, this goes back to my point that same label name across the dashboard will pick same color because default series colors are predefined.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

robertlynch2020
Motivator

Will do. Thanks for your help 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...