topic Re: Define specific Pie Chart colors by string field values in Dashboards & Visualizations

Define specific Pie Chart colors by string field values

gfuente — Wed, 05 Jun 2013 08:28:30 GMT

Hello

I have a search like this:

sourcetype="xxx" | eval severity= upper(severity) | stats count by severity

It works fine, and give us the results we need. Then we add it to a Dashboard, using a pie chart, so we get the distribution of events by severity, thats fine. The results table looks like:

severity    count
INFO        29
CONFIG      2

Now the user asked us, to use specific colors for each severity value, for example use red color for "ERROR" events, yellow color for "INFO" events, and so on.

I found this answer:
http://splunk-base.splunk.com/answers/58335/change-chart-bar-color-based-on-data-value

But it appear that only works for colums chart, not for pie charts.

Thanks in advance

Re: Define specific Pie Chart colors by string field values

davidcif — Fri, 26 Jul 2013 14:15:01 GMT

Hi,try this:

1- order the results by severity. i.e. | order severity

2- use the seriesColors property to assign a color to each severity. You will have to write the colors in the same order as the severity values are listed in your results.

<option name="charting.seriesColors">[0xFF9900,0x00CC00]</option>

3- get rid of "other" in pie chart.

<option name="charting.chart.sliceCollapsingThreshold">0</option>

Let me know if it works! Cheers,

Re: Define specific Pie Chart colors by string field values

FRoth — Tue, 10 Dec 2013 11:55:17 GMT

but severity is a string value. Sorting would not solve the problem, wouldn't it?

Re: Define specific Pie Chart colors by string field values

gfuente — Tue, 10 Dec 2013 12:01:39 GMT

The problem of this solution, is that you could not have events of all severities all times. Then if there are not events of one severity, the next ones will get undesired colors.

Re: Define specific Pie Chart colors by string field values

laristote — Fri, 22 Aug 2014 12:34:23 GMT

This one is working:
http://answers.splunk.com/answers/131726/status-codes-color-on-pie-chart