Hi, splunkers
I have four hosts and query:
index=myIndex
| timechart span=20m max(counterMetric.sampleCount) as CounterMetric max(durationMetric.value) as DurationMetric by host
so in result i have four columns and four lines(i added DurationMetric to overlay) each in a different color, i want to set the same colors for each line and column from the same host
i tryed to solve it like this
option name="charting.legend.labels">[CounterMetric: host1,DurationMetric: host1...]
option name="charting.seriesColors">[0xFF0000,0xFF0000]...
and like this
option name="charting.fieldColors">
{"CounterMetric: host1":0xFF0000,"DurationMetric: host1":0xFF0000,....}
/option>
but it did not lead to the desired result
How can i do this?
@mishaaaaaaaaaa
Did you tried with enclosing fields names and colors in quote?
like:
<option name="charting.legend.labels">["CounterMetric: host1","DurationMetric: host1",...]</option >
<option name="charting.seriesColors">["0xFF0000","0xFF0000"]...</option >
and
<option name="charting.fieldColors">
{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}
</option>
Thanks
I understood the reason of the problem, i tryed to set one or two colors instead of all because of laziness
Now it works almost correct
Now i have a lot of redunant legends, for example:
<option name="charting.legend.labels">["Counter Metric: host1","Duration Metric: host1",...]</option >
<option name="charting.seriesColors">["0xFF0000","0xFF0000"]...</option >
In legend i see "Counter", "Metric", "host1", "Duration" "Metric:" "host1"
How can i fix it?
And now i fixed this too, just delated this string <option name="charting.legend.labels">["Counter Metric: host1","Duration Metric: host1",...]</option >
thanks for time you spent
Yes for shure, i didn't put "<" becouse in preview i had this:
{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}
instead of this:
{"CounterMetric: host1":"0xFF0000","DurationMetric: host1":"0xFF0000",....}