Dashboards & Visualizations

Adding colors to a bar chart based on string not represented in the chart

MMM1
Loves-to-Learn

I know this question has been asked a lot before, and I've tried implementing the answers, but I must be doing something wrong because it is not working for me. I have a graph with rooms on the x axis and count on the y axis. Each room could be in any of 6 buildings in the data set. I want to color the bars based on the building that the room is in. 

 

This is my search

index="example"  Point_Name=Count 
|$v_hours$
|where isnum(value)
|stats max(value) as PeakCount by Building, Room
|eval building=case(Building=="Building1", "B1")
|sort -PeakCount
|rename PeakCount as Count
|head 10
|table Room, Count

 

This is my xml

 

 

<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">-90</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.seriesColors">{"B1":0xFF0000}</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="height">462</option>

 

 

 

If I table building, count then B1 is labeled on the xaxis under the correct bar, but the color still does not change. What am I missing?

Labels (1)
0 Karma

MMM1
Loves-to-Learn

I've also tried charting.fieldColors in place of .seriesColors and that does not work either. 

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...