All Apps and Add-ons

Splunk Machine Learning Toolkit: Customize formatting (colors) in a Downsampled Line Chart

josephinemho
Path Finder

I'm trying to edit the colors in my Downsampled Line Chart by editing the source code on my dashboard. I've successfully done this with regular line charts, but can't seem to get it working for a Downsampled Line Chart.

Here's what I've got (I added the line <option name="Splunk_ML_Toolkit.LinesViz.seriesColors">[0xFF0000,0x00FF00,0x0000FF]</option> but it's still not working):

  <row>
    <panel>
      <viz type="Splunk_ML_Toolkit.LinesViz">
        <title>pctCPU</title>
        <search>
          <query>index=os  | lookup SADB_Lookup_File_20171009.csv host  | search group=SA  | search index="os" sourcetype="ps" host="*"  | multikv fields pctCPU  | stats max(pctCPU) min(pctCPU) avg(pctCPU) by _time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="Splunk_ML_Toolkit.LinesViz.seriesColors">[0xFF0000,0x00FF00,0x0000FF]</option>
      </viz>
    </panel>
  </row>

0 Karma

dilu_splunk
Splunk Employee
Splunk Employee

Hi Josephinemho,

Unfortunately the downsampled Line Chart ( or any Machine Learning Toolkit built-in Visualization) doesn't support custom options (color, size, etc.) at the moment.

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...