All Apps and Add-ons

Timeline custom visualization - Min/max colors settings don't impact categorical display mode colors.

AlexGaz
Explorer

Hi,

I don't manage to open a support case so I'm writing here: I'm using Timeline custom visualization (Splunk 6.6.2) and I'm seeing that colors range for categorical display mode seem to be fixed, regardless min/max colors you've set.

Sequential display mode correctly reflect colors you set instead.

Do you have same problem?

Many thanks and regards,
Alessandro.

0 Karma
1 Solution

niketn
Legend

@AlexGaz, it is expected for the Categorical Colors to pick default series colors defined in Splunk. They are not dependent on Min/Max color because they are not sequential.

If you want to override default Series Colors assigned via Categorical Colors, you might have to do the same using CSS. If your Series name is fieldName1, you will have to override following CSS

.cccat-fieldName1 {
   fill: red !important;
   srtoke: red !important;
}

Please try out and let us know. I had answered a question on similar lines last month, however, I am unable to find the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@AlexGaz, it is expected for the Categorical Colors to pick default series colors defined in Splunk. They are not dependent on Min/Max color because they are not sequential.

If you want to override default Series Colors assigned via Categorical Colors, you might have to do the same using CSS. If your Series name is fieldName1, you will have to override following CSS

.cccat-fieldName1 {
   fill: red !important;
   srtoke: red !important;
}

Please try out and let us know. I had answered a question on similar lines last month, however, I am unable to find the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AlexGaz
Explorer

Hi niketnilay,

ok, I didn't know they were linked to default Splunk colors: yes, it works (just changing "cccat" and "srtoke" into "ccat" and "stroke" :)).

Thank you!

niketn
Legend

@AlexGaz, Glad to know it worked. I have converted to Answer. Please accept to mark as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AlexGaz
Explorer

Of course!

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...