I have a search like this:
sourcetype="xxx" | eval severity= upper(severity) | stats count by severity
It works fine, and give us the results we need. Then we add it to a Dashboard, using a pie chart, so we get the distribution of events by severity, thats fine. The results table looks like:
severity count INFO 29 CONFIG 2
Now the user asked us, to use specific colors for each severity value, for example use red color for "ERROR" events, yellow color for "INFO" events, and so on.
But it appear that only works for colums chart, not for pie charts.
Thanks in advance
1- order the results by severity. i.e. | order severity
2- use the seriesColors property to assign a color to each severity. You will have to write the colors in the same order as the severity values are listed in your results.
3- get rid of "other" in pie chart.
Let me know if it works! Cheers,
The problem of this solution, is that you could not have events of all severities all times. Then if there are not events of one severity, the next ones will get undesired colors.