Change color of stats count visualization

esmonder — Wed, 06 Sep 2017 02:48:51 GMT

Hi I am new to splunk.

I am trying to do a bar chart viz and trying to color each sourcetype by a color but havent been successful
this is my search index=main| stats count by severity

I tried the below in xml but my data are still all the same color
<option name="charting.fieldColors"> {"high":0xFF0000, "medium":0xFFFF00, "low":0x00FF00</option>

Re: Change color of stats count visualization

kmorris_splunk — Wed, 06 Sep 2017 02:53:53 GMT

I believe you need to use seriesColors instead of fieldColors:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization

Re: Change color of stats count visualization

esmonder — Wed, 06 Sep 2017 02:57:09 GMT

didn't work with seriesColors

Re: Change color of stats count visualization

esmonder — Wed, 06 Sep 2017 03:37:16 GMT

<chart>
        <search>
          <query>index=main |stats count(eval(severity="high")) as red count(eval(severity="medium")) as yellow count(eval(severity="low")) as green by severity</query>
          <!--query> index= main | stats count by sourcetype</query-->
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.fieldColors"> {"red":0xFF0000, "green":0x00FF00, "yellow":0xFFFF00}</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>

found the answer through looking at some other answers here hehe
https://answers.splunk.com/answers/547760/why-are-the-colors-in-my-bar-chart-not-changing-as.html

topic Re: Change color of stats count visualization in Splunk Enterprise

Change color of stats count visualization

Re: Change color of stats count visualization

Re: Change color of stats count visualization

Re: Change color of stats count visualization