Dashboards & Visualizations

How can I change the color on individual columns in a column chart

JMFrank215
Explorer

So I have seen questions that are similar but I can't seem to find anything that helps with my specific question. I have the following search: 

index=x sourcetype="y"
| stats avg(ResponseTime) as "Average Response Time" by Consumer
| eval "Average Response Time"=round('Average Response Time',0)
| replace "comp_a" with "Company A" "comp_b" with "Company B" "comp_c" with "Company C"

This returns the below column chart:

JMFrank215_0-1608184724557.png

The only issue I am having from this point, is that I cannot figure out how to change the color of individual columns (e.g. make the Company A column red, Company B column blue, Company C column green) since they are all displaying that avg(ResponseTime) value. I am currently using this  "<option name="charting.seriesColors">[0x006D9C]</option>" within the chart source to make it this shade of blue. But even if I add commas with other colors within the seriesColors brackets, it does not work. Any suggestions?

Labels (4)
0 Karma

to4kawa
Ultra Champion
companycomp_acomp_bcomp_c
Consumer200300400

 

please make the table like above.

0 Karma

JMFrank215
Explorer

yeah this did not do what I wanted it to. I do not want to set the comps_ to those values, I want the different companies to show the avg(ResponseTime). I don't understand what the fillnull is doing because I don't have any data named "company". Same goes for the last line that created the table

0 Karma

to4kawa
Ultra Champion

sample:

index=_internal | head 1 | fields _raw
| eval comp_a=200,comp_b=300,comp_c=400
| fillnull company value="Consumer"
| table company comp_*

please make the table like above.

0 Karma

JMFrank215
Explorer

This did not work for me, maybe you could explain what that is doing and I could modify as necessary?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...