topic Re: coloring coloumn chart in Dashboards & Visualizations

coloring coloumn chart

smolcj — Thu, 29 Nov 2012 07:24:09 GMT

Hi all,
my search is like index=main | chart count by severity
and i am getting a chart like
count in y axis, error and info in x axis and the color of both columns are blue
i modified the search in view as
index=main | chart count by severity| eval red=if(severity=="ERROR",1,0)|eval green = if(severity=="INFO",1,0)
and charting option to

{"red":0xFF0000,"green":0x00FF00}

but i am getting a wiered chart with top border color as i specified and fill color as count color, also i am not able to drill down it.
please help
Thank you

Re: coloring coloumn chart

jonuwz — Thu, 29 Nov 2012 12:41:59 GMT

pretty sure it should be charting.chart.fieldColors not charting.fieldColors

Re: coloring coloumn chart

smolcj — Thu, 29 Nov 2012 13:03:53 GMT

i tried with this option
charting.chart.fieldColors
but no change, drilldown is also not happening

Re: coloring coloumn chart

jonuwz — Thu, 29 Nov 2012 13:09:55 GMT

can you post the complete XML for the dashboard ?

Re: coloring coloumn chart

lguinn2 — Thu, 29 Nov 2012 22:43:24 GMT

Here is an answer that may help: Change chart bar color based on data value

Note that this technique leverages a side-effect of the stats command; it does not work with the chart command.

Re: coloring coloumn chart

smolcj — Fri, 30 Nov 2012 04:45:42 GMT

Thanks lguinn, it worked well, but i am not able to drill down from the chart, befor changing the color i was able to . but not now,, why?
"PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"
this is the error
please help

Re: coloring coloumn chart

smolcj — Fri, 30 Nov 2012 05:53:36 GMT

is it possible to use an explicit drill down option using
if so /app/search/flashtimeline?q=source=$sources$
here sources is my dropdown box result, how to create a query supporting this drill down
please help

Re: coloring coloumn chart

smolcj — Fri, 30 Nov 2012 06:45:32 GMT

dashboard is in simple xml, it have a dropdown box listing sources and a chart showing the severity

Re: coloring coloumn chart

lguinn2 — Fri, 30 Nov 2012 22:42:44 GMT

The automatic drilldown will not work, because the search has eval commands following the stats command:

You should be able to include an explicit drill-down in the XML, starting with Splunk 5.0. Look here for more info on drill-down: http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Dynamicdrilldownindashboardsandforms