https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58649#M14373 <P>I have a timechart area chart that shows three types of event over time ("Node up", "Node Down' and "Node Rebooted"). I want the "Node UP" series to show in green, "Node Down" in red and "Node Rebooted" in yellow. I was able to get what I wanted using: [0xFFEE33,0x00FF00,0xFF0000]</P> <P>However, I find that from time to time, the colors become rearranged. "Node UP" might become yellow, "Node Down" green and "Node Rebooted" Red. Whenthis happens, I have to rearrange the colors in the charting.seriesColors until I get it right. However, after some time, the colors change again.</P> <P>How can I explicitly set the colors for each series so that each type of event always has the same color?</P> Mon, 10 Dec 2012 14:19:40 GMT ocallender 2012-12-10T14:19:40Z https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58649#M14373 <P>I have a timechart area chart that shows three types of event over time ("Node up", "Node Down' and "Node Rebooted"). I want the "Node UP" series to show in green, "Node Down" in red and "Node Rebooted" in yellow. I was able to get what I wanted using: [0xFFEE33,0x00FF00,0xFF0000]</P> <P>However, I find that from time to time, the colors become rearranged. "Node UP" might become yellow, "Node Down" green and "Node Rebooted" Red. Whenthis happens, I have to rearrange the colors in the charting.seriesColors until I get it right. However, after some time, the colors change again.</P> <P>How can I explicitly set the colors for each series so that each type of event always has the same color?</P> Mon, 10 Dec 2012 14:19:40 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58649#M14373 ocallender 2012-12-10T14:19:40Z https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58650#M14374 <P>I think what you're looking for is here:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization">http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization</A></P> <P>search on the page for charting.legend.masterLegend<BR /> Color assignments (colors to series, series labeled by legend) are index based. (like an array, not a Spunk index) and they're controlled by the "Master Legend". If you have multiple charts, there will be Slave Legends as well. </P> <P>There are nice clear examples of Simple XML and Advanced XML on the doc page.<BR /> This should help.</P> Fri, 15 Mar 2013 15:46:23 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58650#M14374 rsennett_splunk 2013-03-15T15:46:23Z https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58651#M14375 <P>The current reference for <CODE>charting.legend.masterLegend</CODE> (and all other chart configuration) is: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference">http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference</A></P> Wed, 24 Aug 2016 10:48:26 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58651#M14375 DominikGM 2016-08-24T10:48:26Z https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58652#M14376 <P>I was able to use charting.fieldColors as below to hard code color based on fields/series.</P> <PRE><CODE> &lt;option name="charting.fieldColors"&gt;{"average\: duration":0x6666ff,"cnt\: fail":0xff4d4d,"cnt\: success":0x80ff80}&lt;/option&gt; </CODE></PRE> Thu, 26 Mar 2020 22:02:50 GMT https://community.splunk.com/t5/Splunk-Search/Chart-Series-colors-keep-rearranging-themselves/m-p/58652#M14376 nmshaikh 2020-03-26T22:02:50Z