Hi,
in simple XML I've got a search:
* "OK" OR "WARNING" OR "DOWN" OR "UNKNOWN" OR "TESTING" | rex "(?(DOWN|OK|WARNING|UNKNOWN|TESTING))" | chart count by printer_status
and assigned pie colours like:
{DOWN:0xff5050,OK:0x5cad5c,WARNING:0xffcc33,UNKNOWN:0x909090,TESTING:0x909090}
which is great.
Then I added values at the end of the labels (valid solution found on forums) by amending to:
* "OK" OR "WARNING" OR "DOWN" OR "UNKNOWN" OR "TESTING" | rex "(?(DOWN|OK|WARNING|UNKNOWN|TESTING))" | chart count by printer_status | eval foobar_slice = printer_status + " (" + count + ")" | fields foobar_slice, count
which is brilliant but it brings pie colours to defaults as the label is no longer "OK" but for example "OK (5)"
How can I keep consistent colours for labels that vary?
seriesColors property is out of the question because not always all printer_status is present.
I assume this can be achieved similar to when enabling showPercent to true which shows nicely precentage at the end of the label. But in my case I wanted to show count of the printer_status and not the precentage.
... View more
