topic Re: changing colors in a column chart in Dashboards & Visualizations

changing colors in a column chart

a212830 — Wed, 06 Mar 2013 20:21:56 GMT

Is there any way to tell Splunk to automatically assign different colors to columns in a chart?
I created a chart, and they all use the same colors.

Re: changing colors in a column chart

gkanapathy — Wed, 06 Mar 2013 21:27:20 GMT

if you chart "by" a field, each "by" value gets a new series and thus a new color. if you're plotting the same value for a single series, it will just one color for the entire series. so it would be helpful to know what your query is.

Re: changing colors in a column chart

a212830 — Mon, 28 Sep 2020 13:27:30 GMT

Here's the query:

index=coreops sourcetype="snmp_stats" tag::host="ERA_Full" |fields HOST, CONNECTIONS |table HOST, CONNECTIONS |head 7

I'm trying to duplicate a report that is done in Excel manually, and the customers want the values in different colors.

Re: changing colors in a column chart

gkanapathy — Wed, 06 Mar 2013 21:55:02 GMT

Try:

index=coreops sourcetype="snmp_stats" tag::host="ERA_Full" | head 7 | chart sum(CONNECTIONS) as CONNECTIONS by HOST

or max(CONNECTIONS) or avg(CONNECTIONS) as appropriate (though in your case it's going to be the same).

Re: changing colors in a column chart

a212830 — Wed, 06 Mar 2013 23:22:31 GMT

Nothing changed...

Re: changing colors in a column chart

gkanapathy — Wed, 06 Mar 2013 23:54:19 GMT

ah, try adding this:

index=coreops sourcetype="snmp_stats" tag::host="ERA_Full" | head 7 | chart sum(CONNECTIONS) as CONNECTIONS by HOST | eval H=HOST | eval HOST="" | xyseries HOST H CONNECTIONS

Re: changing colors in a column chart

a212830 — Thu, 07 Mar 2013 01:25:35 GMT

Wow. OK, that did it. Any chance you can explain that?

Re: changing colors in a column chart

gkanapathy — Thu, 07 Mar 2013 01:45:40 GMT

I over-complicated it. This does the same, and is easier to understand:

index=coreops sourcetype="snmp_stats" tag::host="ERA_Full" | head 7 | eval xlabel=""| chart sum(CONNECTIONS) by xlabel,HOST | rename xlabel AS HOST

"rename" is just used to name the x-axis. You can also use:

index=coreops sourcetype="snmp_stats" tag::host="ERA_Full" | head 7 | eval xlabel=HOST| chart sum(CONNECTIONS) by xlabel,HOST | rename xlabel AS HOST

which will puts non-empty HOST labels on each column, which may be nicer than the previous, which just sets them to empty. (Though the legend is still there.)

Re: changing colors in a column chart

vsingla1 — Mon, 24 Apr 2017 17:19:04 GMT

this did the trick!! wonderful