topic Timechart command and changing Visualization colors in Splunk Enterprise Security

Timechart command and changing Visualization colors

Hegemon76 — Tue, 10 Apr 2018 17:35:32 GMT

Hello,

I think I've very close to getting this working.....but having issues with the eval command for some reason? Can't seem to figure out why and the error doesn't give me much to go on....

Basically just trying to get different colors into the horizontal barchart.

XML

    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.fieldColors">{"Severe":0xFF0000,"High":0xff8000,"Moderate":0xFFFF00,"Low":0x00FF00,"Very Low":0x0000ff}</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>

Thanks!

Re: Timechart command and changing Visualization colors

Hegemon76 — Tue, 10 Apr 2018 17:46:14 GMT

Answered my own question but a different issue appeared! I was missing two operators in the search string and adjusted the "count=>0" to "count>0"

Since I can't post pictures this is going to be difficult....

In the graph I have the colors and information I want however there is also the "count" field for obvious reasons (it is a timechart). I suppose there is no way to get rid of that?

Re: Timechart command and changing Visualization colors

Anam — Tue, 10 Apr 2018 22:55:37 GMT

Hi @Hegemon

It is great you were able to answer your question! Please post the answer here so the rest of the community can benefit from it. Also please post your second question as a new question so you can get maximum exposure on it.

Thanks!

Re: Timechart command and changing Visualization colors

Hegemon76 — Tue, 10 Apr 2018 22:56:56 GMT

I did post my answer.

I will make another question. Thanks!

Re: Timechart command and changing Visualization colors

niketn — Wed, 11 Apr 2018 09:09:22 GMT

@Hegemon76, I have converted your comment to answer. Please accept the same to mark this question as answered!

Re: Timechart command and changing Visualization colors

Hegemon76 — Wed, 11 Apr 2018 16:43:55 GMT

I believe I have accepted!