I create a piechart that has these results in tabular form.
1 Very High 140
2 Not rated 14
3 Medium 20
4 Low 25
5 High 200
It has 5 values, Very High, Not Rated, Medium, Low, High.
In the above example, I would like to color it so that Not rated is green, Very High is pink, Medium is yellow, Low is grey and High is Red
I have tried different method to color
<module name="HiddenChartFormatter"> <param name="chart">pie</param> <param name="charting.fieldColors">"HIGH":0xFF0000,"MEDIUM":0xFFFF00,"LOW":0x545454",VERY-HIGH":0xFF8300,"NOT_RATED":0x00FF00}</param>
Above code does not work with JSChart on Pie chart.
<module name="HiddenChartFormatter"> <param name="charting.legend.labels">[High, Medium, Low, Very High, Not rated]</param> <param name="charting.seriesColors">[0xFF0000,0xFFFF00,0x545454",0xFF8300,0x00FF00]</param>
seriesColors does not tie a color to a value, so in the above piechart if any value missing will mess up whole color in the piechart.
Note: Not all the time these 5 value is present for specific case.
Am I doing something wrong?
Thanks for prompt response.
My piechart itself generated from postProcess module. and when i append the query code to my postprocess it didn't display anything.
also I don't want any value to show up on the piechart if it has 0 value.
It's a shortcoming in JSChart, in that JSChart doesn't implement the fieldColors property.
as a result, you need to do two things.
1) On the charting param side, you need to have both the
charting.seriesColors key and the
charting.legend.labels key set. (You have already figured this part out)
<param name="charting.seriesColors">[0xFF0000,0xFFFF00,0x545454",0xFF8300,0x00FF00]</param> <param name="charting.legend.labels">[Info, Low, Medium, High, Critical, Fatal]</param>
2) on the search language side, to prevent any of the categories from ever dissappearing from the results, add the following search syntax. You can either tack it onto the end of your existing search, or have it present as a postProcess search. This extra piece of search language will ensure that all 6 categories are always present even if the counts for them are 0.
| append [| stats count | eval Type=split("High,Medium,Low,Very High,Not rated",",") | mvexpand Type] | stats sum(count) as count by Type
Note: this topic has come up a couple times before, although never afaik with a comprehensive answer: http://answers.splunk.com/answers/84459/colouring-piecharts-created-using-jschart