All Apps and Add-ons

Timeline custom visualization - Min/max colors settings don't impact categorical display mode colors.

AlexGaz
Explorer

Hi,

I don't manage to open a support case so I'm writing here: I'm using Timeline custom visualization (Splunk 6.6.2) and I'm seeing that colors range for categorical display mode seem to be fixed, regardless min/max colors you've set.

Sequential display mode correctly reflect colors you set instead.

Do you have same problem?

Many thanks and regards,
Alessandro.

0 Karma
1 Solution

niketn
Legend

@AlexGaz, it is expected for the Categorical Colors to pick default series colors defined in Splunk. They are not dependent on Min/Max color because they are not sequential.

If you want to override default Series Colors assigned via Categorical Colors, you might have to do the same using CSS. If your Series name is fieldName1, you will have to override following CSS

.cccat-fieldName1 {
   fill: red !important;
   srtoke: red !important;
}

Please try out and let us know. I had answered a question on similar lines last month, however, I am unable to find the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@AlexGaz, it is expected for the Categorical Colors to pick default series colors defined in Splunk. They are not dependent on Min/Max color because they are not sequential.

If you want to override default Series Colors assigned via Categorical Colors, you might have to do the same using CSS. If your Series name is fieldName1, you will have to override following CSS

.cccat-fieldName1 {
   fill: red !important;
   srtoke: red !important;
}

Please try out and let us know. I had answered a question on similar lines last month, however, I am unable to find the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AlexGaz
Explorer

Hi niketnilay,

ok, I didn't know they were linked to default Splunk colors: yes, it works (just changing "cccat" and "srtoke" into "ccat" and "stroke" :)).

Thank you!

niketn
Legend

@AlexGaz, Glad to know it worked. I have converted to Answer. Please accept to mark as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

AlexGaz
Explorer

Of course!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...