Dashboards & Visualizations

How can i set the same color for two columns in column chart

mishaaaaaaaaaa
Explorer

Hi, splunkers
I have four hosts and query:

index=myIndex
| timechart span=20m max(counterMetric.sampleCount) as CounterMetric max(durationMetric.value) as DurationMetric by host

so in result i have four columns and four lines(i added DurationMetric to overlay) each in a different color, i want to set the same colors for each line and column from the same host

i tryed to solve it like this

option name="charting.legend.labels">[CounterMetric: host1,DurationMetric: host1...]
option name="charting.seriesColors">[0xFF0000,0xFF0000]...

and like this

option name="charting.fieldColors">
{"CounterMetric: host1":0xFF0000,"DurationMetric: host1":0xFF0000,....}
/option>

but it did not lead to the desired result
How can i do this?

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mishaaaaaaaaaa

Did you tried with enclosing fields names and colors in quote?

like:

<option name="charting.legend.labels">["CounterMetric: host1","DurationMetric: host1",...]</option >
<option name="charting.seriesColors">["0xFF0000","0xFF0000"]...</option >

and

<option name="charting.fieldColors">
{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}
</option>

Thanks

0 Karma

mishaaaaaaaaaa
Explorer

I understood the reason of the problem, i tryed to set one or two colors instead of all because of laziness
Now it works almost correct

Now i have a lot of redunant legends, for example:

<option name="charting.legend.labels">["Counter Metric: host1","Duration Metric: host1",...]</option >
 <option name="charting.seriesColors">["0xFF0000","0xFF0000"]...</option >

In legend i see "Counter", "Metric", "host1", "Duration" "Metric:" "host1"
How can i fix it?

0 Karma

mishaaaaaaaaaa
Explorer

And now i fixed this too, just delated this string <option name="charting.legend.labels">["Counter Metric: host1","Duration Metric: host1",...]</option > thanks for time you spent

0 Karma

mishaaaaaaaaaa
Explorer

Yes for shure, i didn't put "<" becouse in preview i had this:

{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}

instead of this:

{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...