Dashboards & Visualizations

How do I specify field order on Column Chart

CraigF
Explorer

I've built a view that renders a stacked column chart by hour. The fields that are stacked come from the "affiliate" field.

 | timechart span=1h count(Order) by affiliate

There are 5 different values (CSR, Web, etc) for affiliate and I want them stacked in a specific order so that I can apply a specific color scheme to them in the stacked chart. I'm handling the color assignment using the following parameter in my view:

<param name="charting.seriesColors">[0xFF0000,0x374682,0xFF8000,0x3B6F03,0x00FFFF]</param>

Short question: how do I manipulate the order of the affiliates in the stacked columns?

0 Karma
1 Solution

CraigF
Explorer

I figured this out. I just had to pipe the results through

| table _time, CSR, WEB, <redacted>, <redacted>, <redacted>, *

I threw the wildcard on there just in case we add another affiliate in the future.

View solution in original post

CraigF
Explorer

I figured this out. I just had to pipe the results through

| table _time, CSR, WEB, <redacted>, <redacted>, <redacted>, *

I threw the wildcard on there just in case we add another affiliate in the future.

I-Man
Communicator

What happened to the affiliate field? I have a timechart based stacked column based on a field with two values. I want to re-arrange so they are switched on the stacked column.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...