topic Is it possible to change default colors for charts? in Splunk Search

Is it possible to change default colors for charts?

dominiquevocat — Mon, 06 Feb 2017 10:52:39 GMT

Is it possible to change the default colors for charts (seriesColors), preferably so that it survives an upgrade?

I would like to use the colors in the CI for the charts be default ( as far as it goes, not that many colors 🙂 )

Re: Is it possible to change default colors for charts?

mhassan24 — Tue, 07 Feb 2017 18:53:12 GMT

Yes, there is.
You have the option of deliberately assigning colors to series (in order) rather than allowing Splunk to go with default on dashboards:
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization

Re: Is it possible to change default colors for charts?

felipesewaybric — Tue, 07 Feb 2017 19:51:25 GMT

And you can use in the options xml, like this:

{"field1":#23B5F9, "field2":#FB8900, "field3":#FF5733, "field4":#14B87C}

Re: Is it possible to change default colors for charts?

niketn — Wed, 08 Feb 2017 08:47:00 GMT

You can use either or both for fieldColors and seriesColors with your set of colors to be consistent across your app.

[Update]

Following are built in Chart Coloring options (Refer to Chart Color Options in Splunk 6.x Dashboard Examples app)

<option name="charting.backgroundColor">
<option name="charting.foregroundColor">
<option name="charting.fontColor">
<option name="charting.seriesColors">

You can use CSS to override styling as per your need as well. You can override svg segments using !important in CSS. (Refer to Custom Layout Example: Dark example in Splunk 6.x Dashboard Examples App.

/* SVG */
.highcharts-container svg {
    background: #000;
}
.highcharts-container svg>rect:not(.block-background) {
    fill: #000 !important;
    opacity: 0.1;
}
.highcharts-container svg text:not(.single-result):not(.delta-label) {
    fill: #ccc !important;
}

Re: Is it possible to change default colors for charts?

srinivasup — Tue, 28 Feb 2017 14:02:36 GMT

{"Error": 0xFF0000,"Success":0x00FF00}

Re: Is it possible to change default colors for charts?

dominiquevocat — Wed, 01 Mar 2017 09:07:58 GMT

to make it more precise: i would like to change the default stylesheet or something i.e. influence the colors Splunk uses unless you specify something in the xml of a dashboard etc.

Re: Is it possible to change default colors for charts?

jkat54 — Wed, 01 Mar 2017 11:22:08 GMT

See this answer for a detailed explanation:
https://answers.splunk.com/answers/338154/change-color-of-splunk-graph-based-on-string-value.html#answer-337131

Re: Is it possible to change default colors for charts?

aaraneta_splunk — Sat, 11 Mar 2017 17:23:03 GMT

@dominiquevocat - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

Re: Is it possible to change default colors for charts?

marina_rovira — Fri, 11 Aug 2017 15:17:08 GMT

Hello!
Since any answer is accepted, does it mean that is not possible to change the default array with the color I want?

I would like to make the graphs in my dashboard more unified with the company official colors, but not having to change it for every chart.

Thank you in advance.

Re: Is it possible to change default colors for charts?

danielsachse — Wed, 23 Jun 2021 06:01:23 GMT

You can use an undocumented setting in ui-prefs.conf:

[default] display.visualizations.charting.seriesColors = [0xea1b0a,0x1ea2b1,0xb00402,<ADD YOUR COLORS>]

It just didn't work as embedded report. Everywhere else - it looks fine.

If you need to set the seriesColors for a specific embedded report - you can add the property in the stanza of the report in the savedsearches.conf:

[myreport] display.visualizations.charting.seriesColors = [0xea1b0a,0x1ea2b1,0xb00402,<ADD YOUR COLORS>]