Colors on bar chart without changing bar size?

[bmorgenthaler]

So I've gone through I don't know how many of the questions and answers on coloring bar charts but still having no luck.

when I view the dashboard it looks fine size wise but it's all one color, the chart on the left. If I use the commented out section created from some examples in Answers the chart gets the colors but there is a weird gap like an invisible bar and the bars that do show are skinny, the chart on the right.

What the heck is going on and how can I fix it?

[woodcock]

Here is a way that is more controllable than using transpose; it allows you to set the stray count string to anything that you like:

| windbag 
| eval severity =(random() % 4) + 1 
| eval severity = case(severity==1, "critical", severity==2, "high", severity=3, "medium", severity==4, "low") 
| stats count by severity 
| eval sortingSequence=case(severity="critical", 1, severity="high", 2, severity="medium", 3, severity="low", 4, severity="unknown", 5, 1=1, 0) 
| eval severities = printf("%*s", len(severity) + sortingSequence, severity) 
| fields - sortingSequence 
| eval severity = "count"
| xyseries severity severities count

[bmorgenthaler · Accepted solution]

@woodcock I took your suggestion and started from scratch, removed the results sorting too and tried both

    | stats count by severity

and

    | chart count by severity

to see if there would be any difference. Unfortunately neither made any change. I kept digging and found a reference to using transpose to fix it. So I added the following to the end of my query

 | stats count by severity 

        | eval sortingSequence=case(severity="critical", 1, severity="high", 2, severity="medium", 3, severity="low", 4, severity="unknown", 5, 1=1, 0)

        | sort sortingSequence | fields - sortingSequence | transpose 0 header_field="severity" column_name="severity"

Once I added the tranpose it would then recognise the values for the series and color them correctly. I do have a rogue "count" label on the Y axis instead of "high,medium,low" that now though that I can't figure out how to get rid of but I'll accept it.

[woodcock]

See my new answer for more control without transpose.

[woodcock]

It should work the way that you have it. When I have problems like this, I just start over with the search in an ad-hoc search window, set as much as I can ad-hoc, making sure that it looks good, and then do Save as and Dashbaord Panel and add it to my dashboard that way. Then add this XML manually to finish it off:

<init>
   <set token="COLOR_RED">0xDC143C</set>
   <set token="COLOR_YELLOW">0xFFD700</set>
   <set token="COLOR_BLUE">0x4160E1</set>
   <set token="COLOR_BLACK">0x000000</set>
</init>
...
<chart>
....
   <option name="charting.fieldColors">{high:$COLOR_RED$,medium:$COLOR_YELLOW$,low:$COLOR_BLUE$}</option>
</chart>

[woodcock]

Never post pictures without also posting the plain text.

[bmorgenthaler]

Good point, thanks.

[woodcock]

I had to read your screen and then type it in to comment. What a pain.