topic Re: Pie Chart Display Color Based On Status (String Value) in Splunk Search

Pie Chart Display Color Based On Status (String Value)

arielpconsolaci — Wed, 07 Jun 2017 01:15:42 GMT

I have the below data and I am trying to display it in a Pie chart that will display the group in a corresponding color based on their status.
Orange - In Progress
Green - Completed
Red - Not Started

I can't achieve it using stats/chart as I understood that the count is only based on one category (e.g. Status).
I was able to achieve it using xyseries but in a column chart. Anyone who can advise to display in a pie chart?

Group Status
A In Progress
B Completed
C Not Started

Re: Pie Chart Display Color Based On Status (String Value)

niketn — Wed, 07 Jun 2017 07:01:27 GMT

@arielpconsolacion,

You can either use fieldColors or seriesColors SimpleXML chart configuration option depending on whether you know the field names or if all fields are always present respectively. Refer to Simple XML Chart Configuration reference documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_properties

    <option name="charting.fieldColors">{"Completed":0x008000,"In Progress":0xffff00,"Not Started":0xff0000}</option>

With seriesColors you need not provide field names but since the colors are applied in sequence, you have to make sure that all fields/series are always present (or zero if absent) and in the same sequence (in your case you might have to label field names as "1.Completed", "2.In Progress" and "3.Not Started"

    <option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>

Re: Pie Chart Display Color Based On Status (String Value)

arielpconsolaci — Wed, 14 Jun 2017 03:11:40 GMT

Hi @niketnilay,

Thank you for your suggestions above. Chart needs a numerical field in that case mine does not have. Or if I can, i can only count per 1 field ( Group or Status in my example). Any advise on this matter?

Group Status
A In Progress
B Completed
C Not Started

Re: Pie Chart Display Color Based On Status (String Value)

kamlesh_vaghela — Wed, 14 Jun 2017 13:25:25 GMT

@arielpconsolacion

In this case we have to use some tric in search and pie logic.
Below is search make crack pie chart and pass numeric value.

<<YOUR SEARCH>>| table Group Status | eval count=1 | append [| stats count | eval Group="C",Status="Not Started"] | append [| stats count | eval Group="A",Status="In Progress" | append [| stats count | eval Group="B",Status="Completed" ]] | sort Status | table Group count

In this search I'm sorting status and arranging resuls. If any status missing in results, then sorting won't work so I have appended messing status with 0 count.

In pie chart color option I have added below option only.

<option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>

Can you please try it?

I hope it works for you.

Thanks
Kamlesh

Re: Pie Chart Display Color Based On Status (String Value)

aniello_cerrato — Mon, 18 Mar 2019 17:11:37 GMT

Hi,

in my case label is dinamically because contain also the %, for example:

30,1% Completed
23% InProgress

But these values are dinamic so change everytime, how we can manage this scenario?