Dashboards & Visualizations

How to create a Bar Chart with different categories and corresponding color

POR160893
Builder

Hi,

I have a bar chart where I need each bar to represent a different category (each with a different colour), similar to how each section og my pie charts represent a different section:

POR160893_0-1657009696393.png



Here is the XML for my current bar chart?

<chart>
<search>
<query>
| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')

| chart count over "Completion Status"
</query>
</search>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">top</option>
<option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>
</chart>



Can you please help?


Thanks so much!

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Pie chart recognizes the sole groupby variable as series, therefore they are assigned different colors.

Column chart has two variables.  You can turn categories into series by using "by" instead of "over".  But to force "chart" command to recognize this, you also need a constant to chart over.  So, change the search to

| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')
| eval dummy = 0
| chart count over dummy by "Completion Status"

 Hope this helps.

View solution in original post

Tags (1)

yuanliu
SplunkTrust
SplunkTrust

Pie chart recognizes the sole groupby variable as series, therefore they are assigned different colors.

Column chart has two variables.  You can turn categories into series by using "by" instead of "over".  But to force "chart" command to recognize this, you also need a constant to chart over.  So, change the search to

| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')
| eval dummy = 0
| chart count over dummy by "Completion Status"

 Hope this helps.

Tags (1)

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

what's your requirement: to have the same colours in a Histogram and a Pie chart or what else?

If this is your requirement, you have to fix the colours for the values you can have.

You can do this by GUI or by code:

<option name="charting.fieldColors">{"informational":#0099E0,"low":#55C169,"medium":#CBA700,"high":#D41F1F,"critical":#3C444D}</option>

Ciao.

 Giuseppe

POR160893
Builder

The requirement is to have a bar chart where each bar represents the count for a particular category and on the legend, each category bar would be a different colour and the category name will be shown as opposed to count(category) ..... is that possible?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set completion status to something other than a space

| eval "Completion Status"=if('Completion Status'="","N/A",'Completion Status')
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...