https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Bar-Chart-Colours-Not-Working/m-p/440100#M5906 <P>Hi,</P> <P>I have the following search in an ES dashboard panel to order incidents throughout the month by severity in a bar chart:</P> <P>| <CODE>incident_review</CODE> | where _time &gt;= relative_time(now(), "-7d")<BR /> | chart count by urgency<BR /> | eval sort_field=case(urgency=="high",1, urgency=="medium",2, urgency=="low",3, urgency=="informational",4)<BR /> | sort sort_field<BR /> | fields - sort_field<BR /> | rename urgency as "Severity"</P> <P>This shows the chart in the following format:</P> <P><IMG src="https://community.splunk.com/storage/temp/272635-splunksearch.png" alt="alt text" /></P> <P>Though when attempting to add colours to each severity level via the XML dashboard I'm not seeing any results:</P> <PRE><CODE> &lt;option name="charting.fieldColors"&gt;{"high":0xFF0000,"medium":0xFFFF00,"low":0x00FF00}&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;column&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;none&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisEnd&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;none&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; </CODE></PRE> <P>What am I doing wrong here?</P> <P>Thanks,</P> Wed, 30 Sep 2020 00:21:28 GMT adam_dixon95 2020-09-30T00:21:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Bar-Chart-Colours-Not-Working/m-p/440100#M5906 <P>Hi,</P> <P>I have the following search in an ES dashboard panel to order incidents throughout the month by severity in a bar chart:</P> <P>| <CODE>incident_review</CODE> | where _time &gt;= relative_time(now(), "-7d")<BR /> | chart count by urgency<BR /> | eval sort_field=case(urgency=="high",1, urgency=="medium",2, urgency=="low",3, urgency=="informational",4)<BR /> | sort sort_field<BR /> | fields - sort_field<BR /> | rename urgency as "Severity"</P> <P>This shows the chart in the following format:</P> <P><IMG src="https://community.splunk.com/storage/temp/272635-splunksearch.png" alt="alt text" /></P> <P>Though when attempting to add colours to each severity level via the XML dashboard I'm not seeing any results:</P> <PRE><CODE> &lt;option name="charting.fieldColors"&gt;{"high":0xFF0000,"medium":0xFFFF00,"low":0x00FF00}&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;column&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;none&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisEnd&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;none&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; </CODE></PRE> <P>What am I doing wrong here?</P> <P>Thanks,</P> Wed, 30 Sep 2020 00:21:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Bar-Chart-Colours-Not-Working/m-p/440100#M5906 adam_dixon95 2020-09-30T00:21:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Bar-Chart-Colours-Not-Working/m-p/440101#M5907 <P>Have you tried transposing the results? I got this to work with your XML:</P> <PRE><CODE>| makeresults | eval urgency="high" | append [| makeresults | eval urgency="medium"] | append [| makeresults | eval urgency="low"] | append [| makeresults | eval urgency="informational"] | chart count by urgency | transpose 0 header_field=urgency | table count high medium low informational </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6986i2BA407A198C46A47/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 06 May 2019 20:57:48 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Bar-Chart-Colours-Not-Working/m-p/440101#M5907 grittonc 2019-05-06T20:57:48Z