topic Re: Why is "charting.fieldColors" not working? in Splunk Search

Why is "charting.fieldColors" not working?

leomedina — Sat, 29 Apr 2017 07:37:04 GMT

Hello all,

I'm in a pickle here... I've been trying to get the following "charting.fieldColors" changed but for some reason, it isn't working. Greatly appreciate the second set of eyes. I've tried using single quotes and HEX as well but still can't seem to get to change.

        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.fieldColors">{"Success":9BE8AB, "Error":E87D6F}</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">none</option>

Thanks!

Re: Why is "charting.fieldColors" not working?

niketn — Sat, 29 Apr 2017 09:03:48 GMT

@leomedina.... you are missing 0x before the hex color codes

    <option name="charting.fieldColors">{"Success":0x9BE8AB, "Error":0xE87D6F}</option>

You can explore seriesColors as alternative to fieldColors if you do not want to use the names of the fields. This is more like coloring the series based on sequence i.e. first series will get 0x9BE8AB and second 0xE87D6F. If you have more than two series and only two colors defined in seriesColors then third series will pick 0x9BE8AB and so on.

    <option name="charting.seriesColors">[0x9BE8AB, 0xE87D6F]</option>

Re: Why is "charting.fieldColors" not working?

lakshmisri — Wed, 09 Aug 2017 07:51:11 GMT

I gave with 0x but still it is not coming up. The bar chart in my case is horizontal display as opposed to vertical ones

Re: Why is "charting.fieldColors" not working?

niketn — Wed, 09 Aug 2017 10:24:41 GMT

@lakshmisri, so what I understand is that you are using Bar Chart and not Column chart.
The Simple XML Configuration charting.fieldColors or charting.seriesColors should be applicable to Bar Chart as well. Make sure field names used in chart configuration are the same as field in the Splunk search.

Refer to following documentation for the same. You can see that field name is all upper case in the search (see Legends i.e. ERROR etc.) as well as chart configuration.

Also refer to Chart Configuration reference, for some special characters in the field names that need to be escaped.http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_properties

Can you give your current search query or field name? Also have you tried with seriesColors option, whether that would work for your use case.

Re: Why is "charting.fieldColors" not working?

lakshmisri — Tue, 29 Sep 2020 15:16:04 GMT

Basically if i apply for total it is working but for every category am trying to get a color

Re: Why is "charting.fieldColors" not working?

niketn — Wed, 09 Aug 2017 15:55:24 GMT

I hope you understand the difference between fieldColors and seriesColors.

If you split by category you will have to know each field name to apply the fieldColor (you can check out what legend is displayed to come up with Field Names for fieldColor).

If there are two many fields or you do not have fixed field names you should better use seriesColors.

Re: Why is "charting.fieldColors" not working?

lakshmisri — Wed, 09 Aug 2017 17:20:54 GMT

I tried both of these. It is just taking the standard color and not getting applied. Hence not sure how to address it.

Re: Why is "charting.fieldColors" not working?

niketn — Thu, 10 Aug 2017 02:12:56 GMT

Based on the details so far, your field names are td_cnt, fd_count and Total. Is this correct?

Re: Why is "charting.fieldColors" not working?

lakshmisri — Thu, 10 Aug 2017 05:52:55 GMT

Yes finally am showing the Total by Category. So I need to apply the color for the Category

Re: Why is "charting.fieldColors" not working?

niketn — Fri, 11 Aug 2017 01:39:26 GMT

Have you tried something like following?

<option name="charting.fieldColors">{"td_cnt":0x9BE8AB, "fd_count ":0xE87D6F,"Total":0xFF0000}</option>

Re: Why is "charting.fieldColors" not working?

lakshmisri — Fri, 11 Aug 2017 04:54:06 GMT

I want or the values for the category

Re: Why is "charting.fieldColors" not working?

niketn — Fri, 11 Aug 2017 11:45:18 GMT

I am not grasping your request. Do you have fixed field names or not? Can you paste sample output of your query?

In case you do not know your field names your only option would be to use seriesColors instead.

<option name="charting.seriesColors">[0x9BE8AB, 0xE87D6F,0xFF0000}</option>

Re: Why is "charting.fieldColors" not working?

bjo — Tue, 02 Oct 2018 05:53:15 GMT

I have the same problem. Suppose I pass my data through stats into the bar/column chart, e.g. :

stats avg(Duration) as AvgDuration by Method

I expected colors to be applied based on each Method that gets charted out, e.g. "Method1", "Method2", but instead it applies just one color for the field (AvgDuration).

Pie charts work as expected, so it seems like a bug/feature of bar & column charts.

I suspect it's a feature (rather than a bug). Unlike pie charts, which work on a single field, bar charts can work on multiple fields. For example if my stats command was:

stats avg(Duration) as AvgDuration, min(Duration) as MinDuration by Method

My bar chart would have an AvgDuration and MinDuration bar for both "Method1" and "Method2", and it aligns the colors along the field names (AvgDuartion and MinDuration) rather than the series names ("Method1", "Method2").

Is there a way to tell the bar chart to color the series names instead of the field names? Or a way to put the bar chart in single-field mode?

Re: Why is "charting.fieldColors" not working?

niketn — Tue, 02 Oct 2018 17:08:27 GMT

@bjo this is not a bug with Splunk. For the first query when you plot AvgDuration your field name is AvgDuration and its values are average for Method1, Method2 etc.

One of the options would be to use transpose.

 <yourSearch>
| stats avg(Duration) as AvgDuration by Method
|  transpose 0 header_field="Method" column_name="Method"

Similarly,

 <yourSearch>
| stats avg(Duration) as AvgDuration, min(Duration) as MinDuration  by Method
| transpose 0 header_field="Method" column_name="Method"

PS: One of recent answers on similar lines: https://answers.splunk.com/answers/689833/how-do-you-customize-colors-in-a-bar-chart.html#answer-689004

Alternatively if you are on Splunk 6.6 or Higher you can also try out the Trellis Visualization Layout which should give more control to Split Charts based on field of your interest and hence will apply color accordingly.

Please try out and confirm and do up-vote it this helps.

Re: Why is "charting.fieldColors" not working?

bjo — Tue, 02 Oct 2018 18:31:02 GMT

Indeed, I agree it is a feature, and I was able to transpose everything to get it to work.

transpose 0 header_field="Method"

Re: Why is "charting.fieldColors" not working?

MinboChung — Wed, 26 Apr 2023 07:10:30 GMT

A good solution for the issue. Ignore the typo.