Define specific Pie Chart colors by string field values

[gfuente]

Hello

I have a search like this:

sourcetype="xxx" | eval severity= upper(severity) | stats count by severity

It works fine, and give us the results we need. Then we add it to a Dashboard, using a pie chart, so we get the distribution of events by severity, thats fine. The results table looks like:

severity    count
INFO        29
CONFIG      2

Now the user asked us, to use specific colors for each severity value, for example use red color for "ERROR" events, yellow color for "INFO" events, and so on.

I found this answer:
http://splunk-base.splunk.com/answers/58335/change-chart-bar-color-based-on-data-value

But it appear that only works for colums chart, not for pie charts.

Thanks in advance

[davidcif]

Hi,try this:

1- order the results by severity. i.e. | order severity

2- use the seriesColors property to assign a color to each severity. You will have to write the colors in the same order as the severity values are listed in your results.

<option name="charting.seriesColors">[0xFF9900,0x00CC00]</option>

3- get rid of "other" in pie chart.

<option name="charting.chart.sliceCollapsingThreshold">0</option>

Let me know if it works! Cheers,

[laristote]

This one is working:
http://answers.splunk.com/answers/131726/status-codes-color-on-pie-chart

[gfuente]

The problem of this solution, is that you could not have events of all severities all times. Then if there are not events of one severity, the next ones will get undesired colors.

[FRoth]

but severity is a string value. Sorting would not solve the problem, wouldn't it?