Dashboards & Visualizations

How to create a Bar Chart with different categories and corresponding color

POR160893
Builder

Hi,

I have a bar chart where I need each bar to represent a different category (each with a different colour), similar to how each section og my pie charts represent a different section:

POR160893_0-1657009696393.png



Here is the XML for my current bar chart?

<chart>
<search>
<query>
| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')

| chart count over "Completion Status"
</query>
</search>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">top</option>
<option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>
</chart>



Can you please help?


Thanks so much!

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Pie chart recognizes the sole groupby variable as series, therefore they are assigned different colors.

Column chart has two variables.  You can turn categories into series by using "by" instead of "over".  But to force "chart" command to recognize this, you also need a constant to chart over.  So, change the search to

| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')
| eval dummy = 0
| chart count over dummy by "Completion Status"

 Hope this helps.

View solution in original post

Tags (1)

yuanliu
SplunkTrust
SplunkTrust

Pie chart recognizes the sole groupby variable as series, therefore they are assigned different colors.

Column chart has two variables.  You can turn categories into series by using "by" instead of "over".  But to force "chart" command to recognize this, you also need a constant to chart over.  So, change the search to

| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')
| eval dummy = 0
| chart count over dummy by "Completion Status"

 Hope this helps.

Tags (1)

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893,

what's your requirement: to have the same colours in a Histogram and a Pie chart or what else?

If this is your requirement, you have to fix the colours for the values you can have.

You can do this by GUI or by code:

<option name="charting.fieldColors">{"informational":#0099E0,"low":#55C169,"medium":#CBA700,"high":#D41F1F,"critical":#3C444D}</option>

Ciao.

 Giuseppe

POR160893
Builder

The requirement is to have a bar chart where each bar represents the count for a particular category and on the legend, each category bar would be a different colour and the category name will be shown as opposed to count(category) ..... is that possible?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set completion status to something other than a space

| eval "Completion Status"=if('Completion Status'="","N/A",'Completion Status')
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...