Dashboards & Visualizations

How could I change entire bar graph color based on token?

Questioner
Path Finder

I ask this in Stackoverflow, but I couldn't get answer yet.

This is my question.

I want to change bar graph color based on token value.

For example, when I get token name "fruit",I want to change etire bar graph color depend on token like this.

  • Apple: Red (0xfc4103)
  • banana : Yellow(0xf5db36)
  • grape : Purple(0xa536eb)

(When the token data is "Apple", the entire graph color become Red-0xfc4103-)

So I write down code using "charting.fieldColors"

<panel>
<chart>
<search>
<query>
.......
| eval paint_chart = case("$fruit$"=="Apple","0xfc4103", "$fruit$"=="banana","0xf5db36", "$fruit$"=="grape","0xa536eb")
| chart count by amount_DT
| rename count AS "Number of fruit"
...
<earliest>-10d@d</earliest>
<latest>now</latest>
</search>
....
<option name="charting.fieldColors">{"Number of case" : $results.paint_chart$}</option>
</chart>
</panel>

 But it's not working at all. How could I solve this problem?

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

    <drilldown>
      <set token="fruit">$click.value$</set>
      <eval token="paint_chart">case("$click.value$"=="Apple","0xfc4103", "$click.value$"=="banana","0xf5db36", "$click.value$"=="grape","0xa536eb", 1=1, "0x123456")</eval>
    <drilldown>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Where does the token $fruit$ come from?

Set another token based on $fruit$ and use that.

          <eval token="paint_chart">case("$fruit$"=="Apple","0xfc4103", "$fruit$"=="banana","0xf5db36", "$fruit$"=="grape","0xa536eb")</eval>
        <option name="charting.seriesColors">[$paint_chart$]</option>

 

0 Karma

Questioner
Path Finder

It's come from upper <panel> token like this,

<panel>
<chart>
<search>
<query>.....</query>
</search>
<drilldown>
<set token="fruit">$click.value$</set>
<drilldown>
</chart>
</panel>

 And Could you please me more specific about "Set another token based on $fruit$?

Is it already use another token pased on $fruit$?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<panel>
  <chart>
    <search>
      <query>.....</query>
    </search>
    <drilldown>
      <set token="fruit">$click.value$</set>
      <eval token="paint_chart">case("$fruit$"=="Apple","0xfc4103", "$fruit$"=="banana","0xf5db36", "$fruit$"=="grape","0xa536eb")</eval>
    <drilldown>
  </chart>
</panel>

Questioner
Path Finder

Thank you for your help!

But it still not working...😢

I print "paint_chart" token at the graph title, and it show null, even I added 'else case'.

<eval token="paint_chart">case("$fruit$"=="Apple","0xfc4103", "$fruit$"=="banana","0xf5db36", "$fruit$"=="grape","0xa536eb", 1=1, "0x123456)

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try it this way

    <drilldown>
      <set token="fruit">$click.value$</set>
      <eval token="paint_chart">case("$click.value$"=="Apple","0xfc4103", "$click.value$"=="banana","0xf5db36", "$click.value$"=="grape","0xa536eb", 1=1, "0x123456")</eval>
    <drilldown>

Questioner
Path Finder

Then I can see the whole code about token like this.

When I check the token value like this,

<title> $paint_chart$ </title>

In the UI, It show this.

case("$click.value$"=="Apple","0xfc4103", "$click.value$"=="banana","0xf5db36", "$click.value$"=="grape","0xa536eb", 1=1, "0x12345

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It sounds like you have used <set> rather than <eval> as I suggested

0 Karma

Questioner
Path Finder

OHhhh! 

There was a problem with the splunk our company's management server.

Your suggestion works fine.

REALLY REALLY Thank you for your help!😀

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...