topic How to create different color pie charts with the same field? in Dashboards & Visualizations

How to create different color pie charts with the same field?

dhirendra761 — Mon, 15 Apr 2019 15:39:07 GMT

Hi All,

Below is my requirement. I need to create pie chart with different colors as per attached SS.
I searched a lot but not able to find the solution and Below code would not help for this scenario.

 <option name="charting.fieldColors">{"Error: 0xE4002B, "Success": 0x3b7d3e}</option>

Could you please suggest me on this.

Thanks in advance.

Re: How to create different color pie charts with the same field?

efavreau — Mon, 15 Apr 2019 16:25:07 GMT

Is there something that differentiates each success? For instance, is A web server errors and successes and B is app server errors and successes, that kind of thing? Your picture looks like a trellis visualization. Does it have to be trellis, or could you have 6 different panels?

Re: How to create different color pie charts with the same field?

dhirendra761 — Mon, 15 Apr 2019 16:42:55 GMT

Hi @efavreau yes you are right I am using trails visualization <option name="trellis.enabled">1</option>
my SPL is base search | stats count(status) by server status

Re: How to create different color pie charts with the same field?

grittonc — Mon, 15 Apr 2019 20:14:22 GMT

If you don't mind having "success" with an extra name on it, you can try this method:

| makeresults 
| eval status="success", server="A" 
| append 
    [| makeresults 
    | eval status="success", server="B"]
| append 
    [| makeresults 
    | eval status="failure", server="A"]
| append 
    [| makeresults 
    | eval status="failure", server="B"]
| eval final_status=if(status="success", status." ".server, status)
| stats count by server final_status

Basically you have to make a new field that considers each type of success as its own category, but the failures as the same category. You can still trellis by server. And in the XML you can customize the colors by adding <option name="charting.fieldColors">{"success A":#00ff00 ,"success B":#0000ff,"failure":#ff0000}</option>.

Re: How to create different color pie charts with the same field?

dhirendra761 — Tue, 16 Apr 2019 07:57:56 GMT

Thanks for your suggesation @grittonc ...yes we can by this but it will differ from our requirement.
Hi...@somesoni2 @woodcock @martin_mueller @niketnilay ...do you have any other suggestion please.

Thanks you.

Re: How to create different color pie charts with the same field?

woodcock — Tue, 16 Apr 2019 12:10:18 GMT

I would use a trellis for this and live with everything being the same 2 colors. Why in the world would you ever desire success (or any value) to be multiple colors? That seems crazy to me.

Re: How to create different color pie charts with the same field?

dhirendra761 — Tue, 16 Apr 2019 12:42:01 GMT

ok understand .. I will follow the natural approach of splunk..and use the same colors for same result .. 🙂

Thanks @woodcock for the suggation.

Re: How to create different color pie charts with the same field?

woodcock — Fri, 22 Nov 2019 22:43:52 GMT

This is the best that I could do but I'll bet that @niketnilay can do better.

Re: How to create different color pie charts with the same field?

woodcock — Fri, 22 Nov 2019 22:51:23 GMT

Actually instead of success A and success B, just use different numbers of leading spaces and use success, success, success, success, success, success. The spaces will be invisible and you will have 100% of your request implemented! GO TEAM!