<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic changing bars colors by a string value of a field in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313387#M20075</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I have a simple bar chart that sums a number("SLOC") by another field("file").&lt;BR /&gt;
each file has another field that describes it - "sloc_type" - and I want to change the files bars colors by the "sloc_type" field.&lt;/P&gt;

&lt;P&gt;example to the chart now:&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/217852-capture.png" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;the "sloc_type" field has only 2 options: rtl, verif.&lt;/P&gt;

&lt;P&gt;I need the files bar to be in a specific color, in order to separate them by their "sloc_type"&lt;/P&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 16:18:44 GMT</pubDate>
    <dc:creator>matansocher</dc:creator>
    <dc:date>2020-09-29T16:18:44Z</dc:date>
    <item>
      <title>changing bars colors by a string value of a field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313387#M20075</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;I have a simple bar chart that sums a number("SLOC") by another field("file").&lt;BR /&gt;
each file has another field that describes it - "sloc_type" - and I want to change the files bars colors by the "sloc_type" field.&lt;/P&gt;

&lt;P&gt;example to the chart now:&lt;BR /&gt;
&lt;IMG src="https://community.splunk.com/storage/temp/217852-capture.png" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;the "sloc_type" field has only 2 options: rtl, verif.&lt;/P&gt;

&lt;P&gt;I need the files bar to be in a specific color, in order to separate them by their "sloc_type"&lt;/P&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 16:18:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313387#M20075</guid>
      <dc:creator>matansocher</dc:creator>
      <dc:date>2020-09-29T16:18:44Z</dc:date>
    </item>
    <item>
      <title>Re: changing bars colors by a string value of a field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313388#M20076</link>
      <description>&lt;P&gt;my search:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=testeda_p groupID=sloc_data 
| search project=Periph core=ipa core_ver=4.2.0
| stats sum(sloc) as SLOC by file
| sort -SLOC
| head 10
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 16 Oct 2017 08:56:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313388#M20076</guid>
      <dc:creator>matansocher</dc:creator>
      <dc:date>2017-10-16T08:56:51Z</dc:date>
    </item>
    <item>
      <title>Re: changing bars colors by a string value of a field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313389#M20077</link>
      <description>&lt;P&gt;try creating a Stacked bar chart with the following query:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; index=testeda_p groupID=sloc_data 
 | search project=Periph core=ipa core_ver=4.2.0
 | chart sum(sloc) as SLOC over file by sloc_type
 | sort -SLOC
 | head 10
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 16 Oct 2017 09:53:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313389#M20077</guid>
      <dc:creator>niketn</dc:creator>
      <dc:date>2017-10-16T09:53:31Z</dc:date>
    </item>
    <item>
      <title>Re: changing bars colors by a string value of a field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313390#M20078</link>
      <description>&lt;P&gt;thanks. it really got me closer to what I needed&lt;/P&gt;</description>
      <pubDate>Mon, 16 Oct 2017 13:19:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313390#M20078</guid>
      <dc:creator>matansocher</dc:creator>
      <dc:date>2017-10-16T13:19:53Z</dc:date>
    </item>
    <item>
      <title>Re: changing bars colors by a string value of a field</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313391#M20079</link>
      <description>&lt;P&gt;@matansocher, glad it helped! Please let us know if something is still not as expected or if you need further help &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 16 Oct 2017 13:26:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/changing-bars-colors-by-a-string-value-of-a-field/m-p/313391#M20079</guid>
      <dc:creator>niketn</dc:creator>
      <dc:date>2017-10-16T13:26:55Z</dc:date>
    </item>
  </channel>
</rss>

