Dashboards & Visualizations

Dashboard with Stacked Chart Custom Field Colors

acehlis
Engager

I've created a dashboard with four separate stacked charts. Each stacked chart has four fields: FAILURE, WARNING, OTHER, SUCCESS. I've modified the XML of the dashboard using:

<option name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xFF00FF,"SUCCESS":0x00FF00}</option>

But these modifications don't make it into my dashboard charts. Am I missing something or doing something wrong? I've tried several different ways of doing this and nothing seems to change the colors of the fields. Thanks.

0 Karma

acehlis
Engager

Yeah, I was afraid of that. I had seen that post, but it looked like the fix was a global tweek. I was able to get it presented with the FlashChart module, however I'm not sure that will be the best option in the long run. We have iPads being deployed to leadership, more and more.

I'd also like to note that it wasn't easy to find all the modules required to make the FlashChart look like the JSChart. It would be a nice documentation feature to break out examples in both JSChart and FlashChart.

Here's my FlashChart example, in case anyone else is looking to do the same thing, but hopefully JSChart gets the functionality soon:


<?xml version='1.0' encoding='utf-8'?>
<view template="dashboard.html">
<label>FlashChart Module Dashboard Example</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1"
group="Work Week (7AM Monday through 5PM Friday)" autoRun="True">
<param name="search">
search source=foo sourcetype=bar eventtype=workweek_hours | timechart span=1w count(TYPE) by TYPE usenull=f fixedrange=f
</param>
<param name="earliest">-365d@d</param>
<param name="latest">@d</param>
<module name="ResultsHeader">
<param name="entityName">scanned</param>
<param name="entityLabel">Events</param>
<module name="HiddenChartFormatter">
<param name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xBE00FF,"ACTIVE_OR_SUCCESS":0x00FF00}</param>
<param name="charting.chart.stackMode">stacked</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.data">results</param>
<module name="FlashChart">
<param name="height">400px</param>
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</view>

tysonstewart
Path Finder

When charts switched from default Flash to JSChart, I think they lost the fieldColors ability.
Related question and documentation. If you're OK with your chart using Flash, just specify the FlashChart module for that chart.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...