How to change colour of graphs?

[wuming79]

Hi,

IS it possible to change colour of individual bar in a bar chart of say 5 different items?

[wuming79]

Hi, actually I needed to change the color of individual bars in the chart. The "fieldColor" only changed the color of the "Count" field.
Currently all my "Class" field are in blue color.

[niketn]

Thanks for adding the details, I have updated my answer with the query you need for your use case. You would need to create fieldColors for specific Class values, whether it is always present or not). Please try out and accept answer if it works for you.

[wuming79]

Hi Niketnilay,

What if the number of bar charts is not fixed and it can change to more bar charts later? How do I pre-define the new charts?

[niketn · Accepted solution]

[Update: Added Search query based on Use Case]

Since field colors are applied based on series being plotted in chart and in your case there is only one series i.e. count, you will need to inverse the the stats generated

<YourBaseSearch>
| top limit=10 Class showperc=f countfield="ClassCount"
| reverse
| transpose header_field="Class" column_name="Class"
| search Class="ClassCount" 

Also you would need to know all Class names and apply fieldColors for all series (whether it is present or not so that they always pick up the same color.
PS: Reverse is required prior to transpose for sorting as per visualization you are using (bar vs column).

---

You can do it via Simple XML Chart Configuration using either

charting.fieldColors -> When you know the field names you can define colors for the same.

    <option name="charting.fieldColors">
      {"ERROR": 0xFF0000, "WARN": 0xFF9900, "INFO":0x0066FF, "NULL":0xC4C4C0}
    </option>

charting.seriesColors -> You define series colors (i.e. override existing Splunk's default seriesColors with your own.). You need not know the fieldNames, however, should ensure that all series you expect are present in the chart and are always in the same sequence for consistency.

    <option name="charting.seriesColors">
        [0xFF0000, 0xFF9900, 0x0066FF, 0xC4C4C0]
    </option>

Refer to Splunk's Chart Configuration reference documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...