How do you color a pie chart that has variable results on its field?

[abdullahalhabba]

Hi Splunker,

I need to control for the color on a pie chart, I used the following query:

{"critical": 0xFF0000, "high": 0xFF9900, "medium":0x0066FF, "low":0xC4C4C0, "informational":0x00FF01}

But this query doesn't work because I have variable results on severity field, you can see the screen shot.

I have used the following search:

my search| top threat:severity | rename threat:severity as threat_severity | eval signature_slice = "Count: " + count + ", " + threat_severity | fields signature_slice count 

Please I need your support.

[mayurr98]

Hi I think you can control colors but then you can not show count on the pie chart instead you can show percentage.

then change your query to :

my search| top showperc=f threat:severity | rename threat:severity as threat_severity

And in XML use

<option name="charting.fieldColors">
  {"critical": 0xFF0000, "high": 0xFF9900, "medium":0x0066FF, "low":0xC4C4C0, "informational":0x00FF01}
</option>
<option name="charting.chart.showPercent">true</option>

lets see if anybody has better solution for you.
let me know if this helps!

[abdullahalhabba]

Hi, Thank you My friend,

Yes I know that about I can
show percentage.

But I need show count with control for color.

[mayurr98]

Well as far as I know this is not possible using XML conf.

[abdullahalhabba]

Ok, is I can do that by use the search.

Thank you