topic Re: how to show different colors for each bar in bar chart in Dashboards & Visualizations

how to show different colors for each bar in bar chart

ramki1459 — Thu, 07 Jun 2018 21:11:34 GMT

|query
| stats count by app_status| eventstats sum(count) as totalCount 
| eval percentage=round((count/totalCount)*100,3)
| fields - count totalCount
| chart max(percentage) by app_status

i want to show results in bar chart. with above query i am able to see the bar chart, but all bars have same color. is there way to show different colors for each bar? thanks in advance

Re: how to show different colors for each bar in bar chart

somesoni2 — Thu, 07 Jun 2018 21:33:33 GMT

Give this a try

|query
 | stats count by app_status| eventstats sum(count) as totalCount 
 | eval percentage=round((count/totalCount)*100,3)
 | fields - count totalCount | eval temp=app_status
 | chart max(percentage) by t app_status temp

Re: how to show different colors for each bar in bar chart

niketn — Fri, 08 Jun 2018 07:15:46 GMT

@ramki1459, try the following search.

<yourBaseSearch>
| top 0 app_status showcount=f
| transpose 0 header_field="app_status" column_name="app_status" 
| search component!="_*" 
| chart max(percentage) by app_status

PS: I have used limit=0 to show maximum allowed fields. However, you can use specific number if you know what could be the upper limit for unique app_status field values. The following run anywhere example based on Splunk's _internal index shows only 5 of all the components.

index=_internal sourcetype=splunkd log_level!="INFO" component!="Metrics" OR component!="PeriodicHealthChecker" 
| top 5 component showcount=f 
| transpose 5 header_field="component" column_name="component" 
| search component!="_*"

Please try out and confirm!

Re: how to show different colors for each bar in bar chart

ramki1459 — Fri, 08 Jun 2018 17:08:58 GMT

thank you so much. it worked 🙂

Re: how to show different colors for each bar in bar chart

Nadhiyaa — Sun, 14 Apr 2019 07:52:13 GMT

@niketnilay When i try the bars are not in the descendingly sorted . How to fix that

Re: how to show different colors for each bar in bar chart

niketn — Sun, 14 Apr 2019 09:00:56 GMT

@Nadhiyaa what is the query you are using. The top command in the above example applies reverse sorting based on volume for a field. So this is supposed to work. Did you try out the run anywhere example based on Splunk's _internal index?

Re: how to show different colors for each bar in bar chart

Nadhiyaa — Thu, 18 Apr 2019 08:26:20 GMT

@niketnilay yes the color changes but the visualization doesn't look from top to bottom .

Re: how to show different colors for each bar in bar chart

niketn — Thu, 18 Apr 2019 21:07:28 GMT

For me a Column or Bar chart works fine not sure which visualization you are using and what is your query. I have changed the query to stats to see if this is what you are using.

index=_internal sourcetype=splunkd
| stats count by log_level 
| eventstats sum(count) as totalCount 
| eval percentage=round((count/totalCount)*100,3) 
| fields - count totalCount 
| chart max(percentage) as "Percentage (max)" by log_level
| sort 0 - "Percentage (max)"
| transpose 0 header_field=log_level column_name=log_level

If this does not work kindly post the query you are using as a new question!