Dashboards & Visualizations

How can i set the same color for two columns in column chart

mishaaaaaaaaaa
Explorer

Hi, splunkers
I have four hosts and query:

index=myIndex
| timechart span=20m max(counterMetric.sampleCount) as CounterMetric max(durationMetric.value) as DurationMetric by host

so in result i have four columns and four lines(i added DurationMetric to overlay) each in a different color, i want to set the same colors for each line and column from the same host

i tryed to solve it like this

option name="charting.legend.labels">[CounterMetric: host1,DurationMetric: host1...]
option name="charting.seriesColors">[0xFF0000,0xFF0000]...

and like this

option name="charting.fieldColors">
{"CounterMetric: host1":0xFF0000,"DurationMetric: host1":0xFF0000,....}
/option>

but it did not lead to the desired result
How can i do this?

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mishaaaaaaaaaa

Did you tried with enclosing fields names and colors in quote?

like:

<option name="charting.legend.labels">["CounterMetric: host1","DurationMetric: host1",...]</option >
<option name="charting.seriesColors">["0xFF0000","0xFF0000"]...</option >

and

<option name="charting.fieldColors">
{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}
</option>

Thanks

0 Karma

mishaaaaaaaaaa
Explorer

I understood the reason of the problem, i tryed to set one or two colors instead of all because of laziness
Now it works almost correct

Now i have a lot of redunant legends, for example:

<option name="charting.legend.labels">["Counter Metric: host1","Duration Metric: host1",...]</option >
 <option name="charting.seriesColors">["0xFF0000","0xFF0000"]...</option >

In legend i see "Counter", "Metric", "host1", "Duration" "Metric:" "host1"
How can i fix it?

0 Karma

mishaaaaaaaaaa
Explorer

And now i fixed this too, just delated this string <option name="charting.legend.labels">["Counter Metric: host1","Duration Metric: host1",...]</option > thanks for time you spent

0 Karma

mishaaaaaaaaaa
Explorer

Yes for shure, i didn't put "<" becouse in preview i had this:

{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}

instead of this:

{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...