Dashboards & Visualizations

How can I change the color on individual columns in a column chart

JMFrank215
Explorer

So I have seen questions that are similar but I can't seem to find anything that helps with my specific question. I have the following search: 

index=x sourcetype="y"
| stats avg(ResponseTime) as "Average Response Time" by Consumer
| eval "Average Response Time"=round('Average Response Time',0)
| replace "comp_a" with "Company A" "comp_b" with "Company B" "comp_c" with "Company C"

This returns the below column chart:

JMFrank215_0-1608184724557.png

The only issue I am having from this point, is that I cannot figure out how to change the color of individual columns (e.g. make the Company A column red, Company B column blue, Company C column green) since they are all displaying that avg(ResponseTime) value. I am currently using this  "<option name="charting.seriesColors">[0x006D9C]</option>" within the chart source to make it this shade of blue. But even if I add commas with other colors within the seriesColors brackets, it does not work. Any suggestions?

Labels (4)
0 Karma

to4kawa
Ultra Champion
companycomp_acomp_bcomp_c
Consumer200300400

 

please make the table like above.

0 Karma

JMFrank215
Explorer

yeah this did not do what I wanted it to. I do not want to set the comps_ to those values, I want the different companies to show the avg(ResponseTime). I don't understand what the fillnull is doing because I don't have any data named "company". Same goes for the last line that created the table

0 Karma

to4kawa
Ultra Champion

sample:

index=_internal | head 1 | fields _raw
| eval comp_a=200,comp_b=300,comp_c=400
| fillnull company value="Consumer"
| table company comp_*

please make the table like above.

0 Karma

JMFrank215
Explorer

This did not work for me, maybe you could explain what that is doing and I could modify as necessary?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...