Dashboards & Visualizations

How can I change the color on individual columns in a column chart

JMFrank215
Explorer

So I have seen questions that are similar but I can't seem to find anything that helps with my specific question. I have the following search: 

index=x sourcetype="y"
| stats avg(ResponseTime) as "Average Response Time" by Consumer
| eval "Average Response Time"=round('Average Response Time',0)
| replace "comp_a" with "Company A" "comp_b" with "Company B" "comp_c" with "Company C"

This returns the below column chart:

JMFrank215_0-1608184724557.png

The only issue I am having from this point, is that I cannot figure out how to change the color of individual columns (e.g. make the Company A column red, Company B column blue, Company C column green) since they are all displaying that avg(ResponseTime) value. I am currently using this  "<option name="charting.seriesColors">[0x006D9C]</option>" within the chart source to make it this shade of blue. But even if I add commas with other colors within the seriesColors brackets, it does not work. Any suggestions?

Labels (4)
0 Karma

to4kawa
Ultra Champion
companycomp_acomp_bcomp_c
Consumer200300400

 

please make the table like above.

0 Karma

JMFrank215
Explorer

yeah this did not do what I wanted it to. I do not want to set the comps_ to those values, I want the different companies to show the avg(ResponseTime). I don't understand what the fillnull is doing because I don't have any data named "company". Same goes for the last line that created the table

0 Karma

to4kawa
Ultra Champion

sample:

index=_internal | head 1 | fields _raw
| eval comp_a=200,comp_b=300,comp_c=400
| fillnull company value="Consumer"
| table company comp_*

please make the table like above.

0 Karma

JMFrank215
Explorer

This did not work for me, maybe you could explain what that is doing and I could modify as necessary?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...