topic Re: Splunk Visualization displaying the same color for both columns in Splunk Search

Splunk Visualization displaying the same color for both columns

TallBear — Thu, 20 Feb 2025 11:28:54 GMT

I am using the following query to display a result on a dashboard (query with sample data which resembles the data I use):

| makeresults | eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development" | makemv delim=";" zip | mvexpand zip | table zip _time ```End of sample data``` | rex field=zip "(?<ticket>.+?),(?<Status>.+$)" | stats values(ticket) as tickets by Status | stats count(tickets) as amount by Status

And this is being returned by visualization:

The issue I'm facing is both columns have the same color, but I want to each column to have its own unique color (this doesn't have to be predefined, it would be okay if Splunk itself chooses random colors).

Thanks in advance!

Edit: typo

Re: Splunk Visualization displaying the same color for both columns

ITWhisperer — Thu, 20 Feb 2025 10:27:22 GMT

Charts are coloured by series i.e. each series has a different colour (until you have lots of series and the colours recycle). In your case, you only have one series, Status, which has two values. To get different colours, you need different series.

| makeresults | eval zip=split("Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development",";") | mvexpand zip | table zip _time ```End of sample data``` | rex field=zip "(?<ticket>.+?),(?<Status>.+$)" | chart count(ticket) as tickets by _time Status

Re: Splunk Visualization displaying the same color for both columns

kiran_panchavat — Thu, 20 Feb 2025 10:30:22 GMT

@TallBear

If you want to change the color, please use this.

In the source code you have to add an option inside the chart tag.

For the Column Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#66FF00,"date_hour":#FF0000,"amount":#00009C}</option>

Here status , and amount are the fields names of the column chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color . You can put any hexadecimal color codes as per your wish.

Re: Splunk Visualization displaying the same color for both columns

kiran_panchavat — Thu, 20 Feb 2025 10:32:41 GMT

@TallBear

Green:-

You can use hexadecimal color to change it.

Re: Splunk Visualization displaying the same color for both columns

kiran_panchavat — Thu, 20 Feb 2025 10:33:29 GMT

@TallBear

For the Bar Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#00FF00,"date_hour":#FFF700,"count":#00009C}</option>

Here status , date_hour and count are the fields names of the bar chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color . You can put any hexadecimal color codes as per your wish.

After adding the options in the source code click on Save to save the changes.

NOTE: change your field name in the code.

Re: Splunk Visualization displaying the same color for both columns

livehybrid — Thu, 20 Feb 2025 13:05:03 GMT

Hi @TallBear

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will