Dashboards & Visualizations

Bar/Column Chart Color for Multi Values

Naa_Win
Path Finder

Hello,

Below Column Chart Results and visualization, I wanted to show different colors for field Values.

like AU Pre & AU Post as one color 
DE Pre & DE Post as one color. 

I'm using this but doesn't work 

<option name="charting.fieldColors">{"AU Pre":0x333333,"AU Post":0xd93f3c,"JP Pre":0xeeeeee,"JP Post":0x65a637,"DE Pre":0xeeeeee,"DE Post":0x65a637}</option>

market           limit             spend

AU Pre1462912884854
AU Post21605671166031
DE Pre9121776973
DE Post16022197906
JP Pre16217121015115
JP Post27873941282541
   
   

Naa_Win_0-1697558913536.png

 

Labels (1)
Tags (1)
0 Karma
1 Solution

_JP
Contributor

That particular property is keyed off of your Y fields, not the X-field that you'd like.  For example, to change the colors with your field names, you'd do something like this - but I understand this isn't what you're looking for:

 

<option name="charting.fieldColors">{"limit":0x333333,"spend":0xd93f3c}</option>

 


I came up with a real hack way to do this...someone who knows more than me might have a better way,,,

Since this chart property is keyed off the name of the y-fields, then you could custom-name all the Y-fields so you can reference them in the fieldColors property.  Here is some example SPL with a bunch of evals to really show how you can split these up:

 

| makeresults format=csv data="market,limit,spend
\"AU Pre\",	1462912,	884854
\"AU Post\",	2160567,	1166031
\"DE Pre\",	91217,	76973
\"DE Post\",	160221,	97906"

| eval AU_Pre_limit = if(market="AU Pre",limit,null)
| eval AU_Post_limit = if(market="AU Post",limit,null)
| eval DE_Pre_limit = if(market="DE Pre",limit,null)
| eval DE_Post_limit = if(market="DE Post",limit,null)
| table market, AU_Pre_limit, AU_Post_limit, DE_Pre_limit, DE_Post_limit, spend

 

 

Then you can build a fieldColors property like this:

 

        <option name="charting.fieldColors">
         {"AU_Pre_limit":0x333333,"AU_Post_limit":0xd93f3c, "DE_Pre_limit":0xeeeeee,"DE_Post_limit":0x65a637, "spend":0xaa0000}
        </option>

 

Here is an example dashboard.  I will also attach the SimpleXML in a PDF so you can try it out:

_JP_0-1697566172375.png

 

** Again...this is very hack and I typically try and keep as much formatting/display info out of my SPL as I can (or at least put it way at the end or do it as a post-process).  This totally breaks any MVC-patterns I like to follow.  But...if you have something you just need to get working and pretty for now, this will do.  

 

View solution in original post

0 Karma

_JP
Contributor

That particular property is keyed off of your Y fields, not the X-field that you'd like.  For example, to change the colors with your field names, you'd do something like this - but I understand this isn't what you're looking for:

 

<option name="charting.fieldColors">{"limit":0x333333,"spend":0xd93f3c}</option>

 


I came up with a real hack way to do this...someone who knows more than me might have a better way,,,

Since this chart property is keyed off the name of the y-fields, then you could custom-name all the Y-fields so you can reference them in the fieldColors property.  Here is some example SPL with a bunch of evals to really show how you can split these up:

 

| makeresults format=csv data="market,limit,spend
\"AU Pre\",	1462912,	884854
\"AU Post\",	2160567,	1166031
\"DE Pre\",	91217,	76973
\"DE Post\",	160221,	97906"

| eval AU_Pre_limit = if(market="AU Pre",limit,null)
| eval AU_Post_limit = if(market="AU Post",limit,null)
| eval DE_Pre_limit = if(market="DE Pre",limit,null)
| eval DE_Post_limit = if(market="DE Post",limit,null)
| table market, AU_Pre_limit, AU_Post_limit, DE_Pre_limit, DE_Post_limit, spend

 

 

Then you can build a fieldColors property like this:

 

        <option name="charting.fieldColors">
         {"AU_Pre_limit":0x333333,"AU_Post_limit":0xd93f3c, "DE_Pre_limit":0xeeeeee,"DE_Post_limit":0x65a637, "spend":0xaa0000}
        </option>

 

Here is an example dashboard.  I will also attach the SimpleXML in a PDF so you can try it out:

_JP_0-1697566172375.png

 

** Again...this is very hack and I typically try and keep as much formatting/display info out of my SPL as I can (or at least put it way at the end or do it as a post-process).  This totally breaks any MVC-patterns I like to follow.  But...if you have something you just need to get working and pretty for now, this will do.  

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...