topic Re: Cant get seperate colors on my bar chart in Splunk Search

How to separate colors on my bar chart

michaelnorup — Fri, 18 Feb 2022 16:04:50 GMT

Hey guys.

So i have a search which created a bar chart

| rex field=_raw "(.Net Version is)\s+(?<DotNetVersion>.+)" | stats latest(DotNetVersion) as DotNetVersion by host | fillnull value="-" | eval status=case(match(DotNetVersion,"Not!"),"noncompliant",1=1,"Compliant") | chart count by status

I have tried most options in the xml but i cant get it to be green/red =/

Any ideas? Thought the ".fieldColors" would do the trick, but i think maybe my field is called "count" instead of Compliant/noncompliant

Re: Cant get seperate colors on my bar chart

ITWhisperer — Fri, 18 Feb 2022 07:49:24 GMT

Try seriesColors

<option name="charting.seriesColors">[#53A051,#DC4E41]</option>

Re: Cant get seperate colors on my bar chart

michaelnorup — Fri, 18 Feb 2022 08:36:06 GMT

This works if i change it to a pie chart, but it changed both colors in the bar chart

Re: Cant get seperate colors on my bar chart

ITWhisperer — Fri, 18 Feb 2022 08:45:54 GMT

Try this

| stats count by status

Re: Cant get seperate colors on my bar chart

michaelnorup — Fri, 18 Feb 2022 08:51:37 GMT

Nope =/

Re: Cant get seperate colors on my bar chart

ITWhisperer — Fri, 18 Feb 2022 09:07:22 GMT

You need a (dummy) x-axis dimension

| eval label="count" | chart count by label status