Bar Chart with colors

[Rgk_Trail]

Hi,

I am trying to assign colors to the bars in my chart.  I have 3 distinct values under variable "Change Type" and I am using charting.fieldColors but for some reason all the bars in the chart appear with default blue color. 

Am I doing something wrong here ? 

<panel>
<chart>
<title>Change Type Analysis</title>
<search base="Base">
<query>
|stats count by "Change Type"|sort -count </query>
</search>
<option name="charting.axisTitleX.text">Change Type</option>
<option name="charting.axisTitleY.text">Number of Changes</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"Standard":0x9BE8AB,"Emergency":0xE87D6F,"Normal":0x5A4575}</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
<option name="height">200</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>

- Rohan

[Rgk_Trail]

Thanks a lot ! it worked. I am also trying to sort the bar charts by the count but looks like it was working before but it doesnt work with eval statements in stats command.  

Can you suggest a way to sort the bars by the count ? 

|stats count(eval(CHG_Type="Normal")) as Normal
count(eval(CHG_Type="Standard")) as Standard
count(eval(CHG_Type="Emergency")) as Emergency by CHG_Type|sort - count
</query>
</search>
<option name="charting.axisTitleX.text">Change Type</option>
<option name="charting.axisTitleY.text">Number of Changes</option>
<option name="charting.chart">bar</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
<option name="charting.fieldColors">{"Standard":#5DADE2,"Emergency":#85C1E9,"Normal":#3498DB}</option>

[renjith_nair]

fieldColors are set based on the field name not the values.

Please see below example.

https://docs.splunk.com/Documentation/SplunkCloud/8.1.2008/Viz/BuildandeditdashboardswithSimplifiedX...

Run anywhere example

<dashboard>
  <label>Chart Colors</label>
  <row>
    <panel>
      <chart>
        <title>Field colors example</title>
        <search>
          <query>
        index = _internal log_level=* | stats
        count(eval(log_level="ERROR")) as ERROR
        count(eval(log_level="WARN")) as WARN
        count(eval(log_level="INFO")) as INFO
        by sourcetype
      </query>
          <earliest>-2h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisY.scale">log</option>
        <option name="charting.chart">column</option>
        <option name="charting.fieldColors">{"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x009900, "NULL":0xC4C4C0}</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</dashboard>