topic Re: Why am I getting duplicate colors in a stacked time chart in Splunk 6.2? in Splunk Search

Why am I getting duplicate colors in a stacked time chart in Splunk 6.2?

vikas_gopal — Fri, 30 Jan 2015 04:51:15 GMT

Hi Experts,

I have an issue with stacked time chart. My search is like

Sourcetype="ABC"| timechart count by dest_ip usenull=f useother=f

I am getting top 10 IP addresses with count but I can see duplicate colors, like yellow color 3 times. Is there any way to provide different color to all 10 different IPs

Thanks
VG

Re: Why am I getting duplicate colors in a stacked time chart in Splunk 6.2?

vikas_gopal — Fri, 30 Jan 2015 05:07:20 GMT

I am facing this issue in Splunk 6.2 version .Same thing is working fine in Splunk 6.0 version.Please suggest if anyone facing such issue in 6.2.

Re: Why am I getting duplicate colors in a stacked time chart in Splunk 6.2?

martin_mueller — Fri, 30 Jan 2015 07:04:53 GMT

You can change the colours to suit your needs using the charting.seriesColors or charting.fieldColors options, see http://docs.splunk.com/Documentation/Splunk/6.2.1/Viz/ChartConfigurationReference#General_chart_properties for reference.

Re: Why am I getting duplicate colors in a stacked time chart in Splunk 6.2?

vikas_gopal — Fri, 30 Jan 2015 09:40:02 GMT

Thanks for the quick response Martin, but with this solution I have to define series color manually , because I am getting random IP as output so how I can fix this .

Re: Why am I getting duplicate colors in a stacked time chart in Splunk 6.2?

martin_mueller — Fri, 30 Jan 2015 12:33:47 GMT

With charting.fieldColors you would have to know the fields (IPs in your case) beforehand, yes.

With charting.seriesColors you can specify your own colours to use for the first, second, and so on field - basically override the automatic assignment of colours Splunk makes by default.

I'm a bit surprised you get colour overlap though, you you post a screenshot? If that's a general issue it'd be nice to get it addressed properly.