Dashboards & Visualizations

Why are the colors in my bar chart not changing as desired?

rkaakaty
Path Finder

So I am trying to change the colors of each bar value. I am not sure why it isnt' working.

Here is my code:

<dashboard>
  <label>Type_Panel</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID
| stats count by TYPE</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.fieldColors">
         {"CONFIRMED": 0xFF0000, "Potential": 0xF87217}
       </option>
      </chart>
    </panel>
  </row>
</dashboard>

Here is the picture of my current bar graph when I save that code:

alt text

0 Karma

cmerriman
Super Champion

Instead of the fieldColors option, try using the seriesColors option.

0 Karma

somesoni2
Revered Legend

The fieldColors expect that "CONFIRMED" and "Potential" are column/field names not values. Your stats command has column/field name as TYPE. Try this search

eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID | eval temp=1
 | chart count by temp TYPE | fields - temp

OR

 eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID
 | stats count(eval(TYPE="CONFIRMED")) as CONFIRMED count(eval(TYPE="Potential")) as Potential

rkaakaty
Path Finder

these options did not work for me

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...