Dashboards & Visualizations

How to change colour of graphs?

wuming79
Path Finder

Hi,

IS it possible to change colour of individual bar in a bar chart of say 5 different items?

1 Solution

niketn
Legend

[Update: Added Search query based on Use Case]

Since field colors are applied based on series being plotted in chart and in your case there is only one series i.e. count, you will need to inverse the the stats generated

<YourBaseSearch>
| top limit=10 Class showperc=f countfield="ClassCount"
| reverse
| transpose header_field="Class" column_name="Class"
| search Class="ClassCount" 

Also you would need to know all Class names and apply fieldColors for all series (whether it is present or not so that they always pick up the same color.
PS: Reverse is required prior to transpose for sorting as per visualization you are using (bar vs column).


You can do it via Simple XML Chart Configuration using either

charting.fieldColors -> When you know the field names you can define colors for the same.

    <option name="charting.fieldColors">
      {"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x0066FF, "NULL":0xC4C4C0}
    </option>

charting.seriesColors -> You define series colors (i.e. override existing Splunk's default seriesColors with your own.). You need not know the fieldNames, however, should ensure that all series you expect are present in the chart and are always in the same sequence for consistency.

    <option name="charting.seriesColors">
        [0xFF0000, 0xFF9900, 0x0066FF, 0xC4C4C0]
    </option>

Refer to Splunk's Chart Configuration reference documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

wuming79
Path Finder

Hi, actually I needed to change the color of individual bars in the chart. The "fieldColor" only changed the color of the "Count" field.
Currently all my "Class" field are in blue color.

alt text

niketn
Legend

Thanks for adding the details, I have updated my answer with the query you need for your use case. You would need to create fieldColors for specific Class values, whether it is always present or not). Please try out and accept answer if it works for you.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

wuming79
Path Finder

Hi Niketnilay,

What if the number of bar charts is not fixed and it can change to more bar charts later? How do I pre-define the new charts?

0 Karma

niketn
Legend

[Update: Added Search query based on Use Case]

Since field colors are applied based on series being plotted in chart and in your case there is only one series i.e. count, you will need to inverse the the stats generated

<YourBaseSearch>
| top limit=10 Class showperc=f countfield="ClassCount"
| reverse
| transpose header_field="Class" column_name="Class"
| search Class="ClassCount" 

Also you would need to know all Class names and apply fieldColors for all series (whether it is present or not so that they always pick up the same color.
PS: Reverse is required prior to transpose for sorting as per visualization you are using (bar vs column).


You can do it via Simple XML Chart Configuration using either

charting.fieldColors -> When you know the field names you can define colors for the same.

    <option name="charting.fieldColors">
      {"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x0066FF, "NULL":0xC4C4C0}
    </option>

charting.seriesColors -> You define series colors (i.e. override existing Splunk's default seriesColors with your own.). You need not know the fieldNames, however, should ensure that all series you expect are present in the chart and are always in the same sequence for consistency.

    <option name="charting.seriesColors">
        [0xFF0000, 0xFF9900, 0x0066FF, 0xC4C4C0]
    </option>

Refer to Splunk's Chart Configuration reference documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...