topic Re: Modify Map Colors In Dashboard Studio in Dashboards & Visualizations

Modify Map Colors In Dashboard Studio

chenfan — Tue, 30 Dec 2025 05:53:46 GMT

Hello Splunkers,

I've been having issues with Dashboard Studio lately that have been bothering me. I'd really appreciate any advice. I want to assign different colors to data based on different field values—green for "normal", yellow for "warning", and red for "critical". I've tried the following configurations, but none of them have worked.

{ "type": "splunk.map", "options": { "center": [ 34.266, 108.945 ], "zoom": 2.3155822324586683, "layers": [ { "seriesColors": [ "#00FF00", "#FFFF00", "#FF0000", "bubbleSize": "> primary | frameBySeriesNames('normal','warning','critical')" } ] }, "dataSources": { "primary": "ds_PHhx1Fxi" }, "context": {}, "showProgressBar": false, "showLastUpdated": false }

Re: Modify Map Colors In Dashboard Studio

chenfan — Tue, 30 Dec 2025 05:56:15 GMT

HI @livehybrid

Can you give me some suggestion? Thankyou!

Re: Modify Map Colors In Dashboard Studio

tscroggins — Tue, 30 Dec 2025 16:59:07 GMT

Hi @chenfan,

You've used the correct syntax for bubbleSize and seriesColor to select a data frame by series names and match the index of each series name to its corresponding color. Assuming "normal" is the dominant status, the screenshot looks correct.

Which part isn't working?

As an aside, Splunk's legacy default RGB values for red, yellow/amber, and green are #cba700, #d41f1f, and #118832, respectively.

Re: Modify Map Colors In Dashboard Studio

chenfan — Wed, 31 Dec 2025 06:09:25 GMT

Hi @tscroggins Thankyou for your reply! When my data only includes "normal" and "critical" statuses, the color assigned to "critical" is yellow——and that’s not what I want.

Re: Modify Map Colors In Dashboard Studio

tscroggins — Wed, 31 Dec 2025 17:02:51 GMT

Hi @chenfan,

I can't reproduce the issue using your layers configuration in Splunk Enterprise 10.0. Which version of Splunk are you using? Can you post a redacted version of your search?

You could try appending an eval after geostats to insert zero values when a field is missing, null, or empty:

| geostats count by status ``` latfield=lat longfield=lon ``` | eval normal=coalesce(tonumber(trim(normal)), 0), warning=coalesce(tonumber(trim(warning)), 0), critical=coalesce(tonumber(trim(critical)), 0)

You can vary the eval command to fit whatever validation logic you prefer, e.g.:

| eval normal=if(isnull(nullif(normal, "")) OR NOT isint(normal), 0, normal), warning=if(isnull(nullif(warning, "")) OR NOT isint(warning), 0, warning), critical=if(isnull(nullif(critical, "")) OR NOT isint(critical), 0, critical)

Re: Modify Map Colors In Dashboard Studio

livehybrid — Wed, 31 Dec 2025 22:38:57 GMT

Hi @chenfan

Since when you're missing a field it throws out the colouring, just make sure you always have the fields in the order you expect - the easiest way to do this is to add a table command to then end of your search:

| table normal warning critical *

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing