How to change bar chart colors for single count

[soulmaker]

Hi, I wanted to have a bar graph that has different colour for better represention of my dashboard. I do have a search like below"

type="request" "request.path"="prod" | stats count by account_namespace | sort - count | head 10

I tried adding the "<option name="charting.seriesColors">[0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f]</option>" but I still get a single colour in my bar graph. I believe since i only one series for my query hence the single colour output. 

Is there a way for me to have my bar graph contains multiple colour?

[bowesmana · Accepted solution]

You can do either of these first to turn it to a multiseries chart

| eval namespace=""
| xyseries namespace account_namespace count

OR

| transpose 0 header_field=account_namespace column_name=account_namespace
| eval account_namespace=""

[soulmaker]

Thanks @bowesmana for your reply and sharing the below. I have now managed to make it multiseries chart by applying you've shared below. However, it is showing the result of all of the account_namespace, is there a way for me to filter the highest 10 count and only shows that?

[bowesmana]

Your original search will already limit the top 10, as you are doing sort+head, so not sure I understand how you are getting all results?

[soulmaker]

Yeah, I am a bit confuse as well. Seems like the last part of the query "| sort - count | head 10" does not really do anything. 

So I've modified my search to be like:

type="request" "request.path"="prod/" | stats count by account_namespace | eval namespace="" | xyseries namespace account_namespace count | sort - count | head 10

by using the above, it gives me a result where the account_namespace shows as a column with all the count as the value. In the column it is showing all of it and not only the top 10 that has highest count. 

[bowesmana]

Put my additional SPL - AFTER your original search - you've added it in the middle

[soulmaker]

This works! thanks man for your help on this one.