Dashboards & Visualizations

How to change the colors of fields in a pie chart (and the values change constantly)

Kirantcs
Path Finder

Hi ,
Assume I have CPU utilization categorized as Critical, Warning and Normal. Now using append I combine individually to show a pie chart. In the piechart, along with Critical values, I also display the number of instance in that state. For ex: let's say there are 20 Critical severs,10 warning servers and 100 Normal servers. So when I display this on a pie chart the number of servers in critical will be displayed as Critical :20, Warning:10, and so on.
I tried it with Charting fields for static words like Critical, Warning, etc., but I don't know how to give color to such case where Critical is taken by Splunk as Critical: 20. I tried by giving "%" wildcards, didn't work.

Note
The server values keep changing.

0 Karma

cmerriman
Super Champion

there isn't any way to wildcard the colors. this is a workaround:

in your query, write out something like ...|eval category2=category+":"+count|eval sort=case(category="Critical",1,category="Warning",2,category="Normal",3)|sort sort|fields category2 count you might want to add something to dummy encode that all categories are there, in case there are no Critical values or something.
something like this:

index=.....|stats count by category|append [|makeresults|eval category="Critical,Warning,Normal"|makemv category delim=","|mvexpand category]|fillnull count value=0|eval category2=category+":"+count|dedup category|eval sort=case(category="Critical",1,category="Warning",2,category="Normal",3)|sort sort|fields category2 count |fields - _time

and then in the simpleXML, put this <option name="charting.seriesColors">[0xff0000,0xff6600,0xffff00]</option> it will use Red, Orange and Yellow, in the order, based on the order the categories were sorted.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...