Dashboards & Visualizations

Colors on bar chart without changing bar size?

bmorgenthaler
Path Finder

So I've gone through I don't know how many of the questions and answers on coloring bar charts but still having no luck.

Here is the chart query in the dashboard: when I view the dashboard it looks fine size wise but it's all one color, the chart on the left. If I use the commented out section created from some examples in Answers the chart gets the colors but there is a weird gap like an invisible bar and the bars that do show are skinny, the chart on the right.alt text

What the heck is going on and how can I fix it?

Tags (2)
0 Karma
1 Solution

bmorgenthaler
Path Finder

@woodcock I took your suggestion and started from scratch, removed the results sorting too and tried both

    | stats count by severity

and
    | chart count by severity

to see if there would be any difference. Unfortunately neither made any change. I kept digging and found a reference to using transpose to fix it. So I added the following to the end of my query
 | stats count by severity 
| eval sortingSequence=case(severity="critical", 1, severity="high", 2, severity="medium", 3, severity="low", 4, severity="unknown", 5, 1=1, 0)
| sort sortingSequence | fields - sortingSequence | transpose 0 header_field="severity" column_name="severity"

Once I added the tranpose it would then recognise the values for the series and color them correctly. I do have a rogue "count" label on the Y axis instead of "high,medium,low" that now though that I can't figure out how to get rid of but I'll accept it.Picture of rogue count label beside the legend

View solution in original post

0 Karma

woodcock
Esteemed Legend

Here is a way that is more controllable than using transpose; it allows you to set the stray count string to anything that you like:

| windbag 
| eval severity =(random() % 4) + 1 
| eval severity = case(severity==1, "critical", severity==2, "high", severity=3, "medium", severity==4, "low") 
| stats count by severity 
| eval sortingSequence=case(severity="critical", 1, severity="high", 2, severity="medium", 3, severity="low", 4, severity="unknown", 5, 1=1, 0) 
| eval severities = printf("%*s", len(severity) + sortingSequence, severity) 
| fields - sortingSequence 
| eval severity = "count"
| xyseries severity severities count
0 Karma

bmorgenthaler
Path Finder

@woodcock I took your suggestion and started from scratch, removed the results sorting too and tried both

    | stats count by severity

and
    | chart count by severity

to see if there would be any difference. Unfortunately neither made any change. I kept digging and found a reference to using transpose to fix it. So I added the following to the end of my query
 | stats count by severity 
| eval sortingSequence=case(severity="critical", 1, severity="high", 2, severity="medium", 3, severity="low", 4, severity="unknown", 5, 1=1, 0)
| sort sortingSequence | fields - sortingSequence | transpose 0 header_field="severity" column_name="severity"

Once I added the tranpose it would then recognise the values for the series and color them correctly. I do have a rogue "count" label on the Y axis instead of "high,medium,low" that now though that I can't figure out how to get rid of but I'll accept it.Picture of rogue count label beside the legend

View solution in original post

0 Karma

woodcock
Esteemed Legend

See my new answer for more control without transpose.

0 Karma

woodcock
Esteemed Legend

It should work the way that you have it. When I have problems like this, I just start over with the search in an ad-hoc search window, set as much as I can ad-hoc, making sure that it looks good, and then do Save as and Dashbaord Panel and add it to my dashboard that way. Then add this XML manually to finish it off:

<init>
   <set token="COLOR_RED">0xDC143C</set>
   <set token="COLOR_YELLOW">0xFFD700</set>
   <set token="COLOR_BLUE">0x4160E1</set>
   <set token="COLOR_BLACK">0x000000</set>
</init>
...
<chart>
....
   <option name="charting.fieldColors">{high:$COLOR_RED$,medium:$COLOR_YELLOW$,low:$COLOR_BLUE$}</option>
</chart>
0 Karma

woodcock
Esteemed Legend

Never post pictures without also posting the plain text.

0 Karma

bmorgenthaler
Path Finder

Good point, thanks.

0 Karma

woodcock
Esteemed Legend

I had to read your screen and then type it in to comment. What a pain.

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on