Hi Splunker,
I need to control for the color on a pie chart, I used the following query:
{"critical": 0xFF0000, "high": 0xFF9900, "medium":0x0066FF, "low":0xC4C4C0, "informational":0x00FF01}
But this query doesn't work because I have variable results on severity field, you can see the screen shot.
I have used the following search:
my search| top threat:severity | rename threat:severity as threat_severity | eval signature_slice = "Count: " + count + ", " + threat_severity | fields signature_slice count
Please I need your support.
Hi I think you can control colors but then you can not show count on the pie chart instead you can show percentage.
then change your query to :
my search| top showperc=f threat:severity | rename threat:severity as threat_severity
And in XML use
<option name="charting.fieldColors">
{"critical": 0xFF0000, "high": 0xFF9900, "medium":0x0066FF, "low":0xC4C4C0, "informational":0x00FF01}
</option>
<option name="charting.chart.showPercent">true</option>
lets see if anybody has better solution for you.
let me know if this helps!
Hi, Thank you My friend,
Yes I know that about I can
show percentage.
But I need show count with control for color.
Well as far as I know this is not possible using XML conf.
Ok, is I can do that by use the search.
Thank you