Dashboards & Visualizations

changing bars colors by a string value of a field

matansocher
Contributor

Hi,

I have a simple bar chart that sums a number("SLOC") by another field("file").
each file has another field that describes it - "sloc_type" - and I want to change the files bars colors by the "sloc_type" field.

example to the chart now:
alt text

the "sloc_type" field has only 2 options: rtl, verif.

I need the files bar to be in a specific color, in order to separate them by their "sloc_type"

Thanks

0 Karma
1 Solution

niketn
Legend

try creating a Stacked bar chart with the following query:

 index=testeda_p groupID=sloc_data 
 | search project=Periph core=ipa core_ver=4.2.0
 | chart sum(sloc) as SLOC over file by sloc_type
 | sort -SLOC
 | head 10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

try creating a Stacked bar chart with the following query:

 index=testeda_p groupID=sloc_data 
 | search project=Periph core=ipa core_ver=4.2.0
 | chart sum(sloc) as SLOC over file by sloc_type
 | sort -SLOC
 | head 10
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

matansocher
Contributor

thanks. it really got me closer to what I needed

0 Karma

niketn
Legend

@matansocher, glad it helped! Please let us know if something is still not as expected or if you need further help 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

matansocher
Contributor

my search:

index=testeda_p groupID=sloc_data 
| search project=Periph core=ipa core_ver=4.2.0
| stats sum(sloc) as SLOC by file
| sort -SLOC
| head 10
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...