topic [Help] Splunk Field Colors in Dashboards & Visualizations

[Help] Splunk Field Colors

Zyon — Wed, 24 Jul 2013 01:35:04 GMT

Hi,
I wanted to display the fields of column chart in different colors according to their occurrence, however the colors are not being displayed.

My search:

source="source.log" INBOUND | fields SRC | fields - _* | top 5 SRC | rangemap field=count green=20000-30000 default=gray

My XML:

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Test0</label>
  <row>
    <chart>
      <searchString>source="source.log" INBOUND | fields SRC | fields - _* | top 5 SRC | rangemap field=count green=20000-30000 default=gray </searchString>
      <title>Test0</title>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">stacked</option>
      <option name="classField">range</option>
    </chart>
  </row>
</dashboard>

Thanks!

Re: [Help] Splunk Field Colors

HiroshiSatoh — Wed, 24 Jul 2013 05:16:59 GMT

"classField"でchartの色を変えることは私もできなかった。スタック棒グラフで"range"毎に集計した結果を表示する方法ではダメか？

I was not able to change the color of the chart in "classField". Do not do it in a way that displays the results aggregated to each "range" in the stack bar chart?

|eval green=if(range=="green",count,0) | eval gray=if(range!="green",count,0) | fields - count,range

Re: [Help] Splunk Field Colors

Zyon — Wed, 24 Jul 2013 06:43:39 GMT

Thank You, it solved my problem.