Arrange the bar chart color based on log_level.

[psriyanka]

Hi all,

Can somebody help me to arrange the bar chart color based on log_level.
Here In the chart attached, I want it to change the values based on the loglevel. When the log_level is Error, it should show it in red color, in Info it should show in Yellow and when in Warn level it should show it in green color.
Here i tried many options, but nothing is working out.
I want when the group values are in the loglevel, it should change the color automatically.

[niketn · Accepted solution]

@psriyanka since you want color by the log_level field, you will have to reverse the sequence of aggregation fields.

Try the following and charting.fieldColors will work

index=_internal sourcetype=splunkd log_level!=INFO
| chart count by component log_level