Dashboards & Visualizations

Dashboard Chart Properties Not Working ?

Contributor

v4.3.1 linux

i created a simple dashboard as below. however, when i try to add some colorizing charting options they do not seem to apply to the chart. bug, or am i doing something wrong? the 1st chart shows up as blue colums on black background with no text. also, when i edit the visualization via the web gui and choose one of the stacked column styles it wont stack the graph. why?

using properties from here
http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/CustomChartingConfig-FontColorBrushPalet...

also, i dont know how to post code sample here as this forum mucks up the chars, so i tries to escape some stuff but this forum then adds chars, very very annoying!

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <label>Quik Firewall View</label>
  <row>
    <chart>
      <searchString>index=cisco_firewall | top error_code limit=5</searchString>
      <title>Top 5 Events in the last 1hr</title>
      <earliestTime>-1h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
      <option name="charting.fontSize">11</option>
      <option name="charting.fontColor">0xFFFFFF</option>
      <option name="charting.backgroundColor">0xFF0000</option>
      <option name="charting.foregroundColor">0x00FF00</option>
      <option name="charting.seriesColors">[0x6CB8CA,0xFAC61D,0xD85E3D,0x956E96,0xF7912C]</option>
    </chart>
    <chart>
      <searchString>index=cisco_firewall | top error_code limit=5</searchString>
      <title>Top 5 Events in the last 24hrs</title>
      <earliestTime>-24h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
    </chart>
  </row>
  <row>
    <table>
      <searchString>index=cisco_firewall earliest=-1h latest=now [search index=cisco_firewall | top error_code limit=5 | table error_code] | stats count(error_code) by error_code event_desc | dedup error_code | sort - count(error_code)</searchString>
      <title>Event Descriptions and Counts for above chart</title>
      <earliestTime>-1h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.backgroundColor">0xFFFFFF</option>
      <option name="charting.fontColor">0xFF0000</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
    </table>
    <table>
      <searchString>index=cisco_firewall earliest=-24h latest=now [search index=cisco_firewall | top error_code limit=5 | table error_code] | stats count(error_code) by error_code event_desc | dedup error_code | sort - count(error_code)</searchString>
      <title>Event Descriptions and Counts for above chart</title>
      <earliestTime>-24h</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.axisTitleX.text">Cisco Firewall Event Code #</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.primaryAxisTitle.text"/>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
      <option name="drilldown">all</option>
    </table>
  </row>
 </dashboard>
0 Karma
1 Solution

Legend

These options are unfortunately currently not supported in the Javascript charting module that is used. More information here: http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/AdvancedCharting

View solution in original post

Legend

These options are unfortunately currently not supported in the Javascript charting module that is used. More information here: http://docs.splunk.com/Documentation/Splunk/4.3.1/Developer/AdvancedCharting

View solution in original post

Contributor

ah, ok. then i guess i need to used advanced XML with flash chart.

0 Karma

Legend

Syntax is well documented here, and is linked in the text box when posting: http://daringfireball.net/projects/markdown/syntax

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!