Dashboards & Visualizations

How to get a Column / Bar Chart change color of bar per Size of Shop?

Altoid17
Explorer

Hi All, 

Have searched for many months and unable to locate what i need. something i believe should be so simple is alluding me..looking for some help on this. 

I am trying to change the colour of a bar / column chart to represent a different colour per the size of the shop and showing how many alarm incidents they have had. Visually this should allow me to see a comparison of alerts across my Large shops / my Small Shops by looking at a color only and not having to remember each shops size. ie all green shops are small. 

My test table is as followed : On my Graph i would like for the Size of the Shop to be color coded - Large - blue, Medium-yellow, Small-green ( the color of the 3 sizes i am not fussy on) . 

Shop Size TypeReport NoEvents
A Large FrontAlarm 76
A Large BackAlarm 115
B Small FrontAlarm 37
B Small BackAlarm 132
C Medium FrontAlarm 81
C Medium BackAlarm 39
D Large FrontAlarm 159
D Large BackAlarm 110
E Small FrontAlarm 26
E Small BackAlarm 71
F Medium FrontAlarm 113
F Medium BackAlarm 49

 

I have tried several Evals but just do not see to be able to get this right. I have tried to follow several answers within the splunk community on this topic, but due to the answers evaluating time - its throwing me out and thus losing that last piece to the puzzle - i have been trying things such as - 

| inputlookup Testcolor.csv
| search TypeReport="FrontAlarm"
| stats count by NoEvents
| eval {NoEvents}=count
| fields - count

and changing the source with the below but still no luck. 

<option name="charting.fieldColors">{"A":#32a838,"B":#006D9C,"C":#006D9C,"D":#32a838,"E":#006D9C,"F":#006D9 }</option>

To even trying 

| inputlookup Testcolor.csv
| search TypeReport="FrontAlarm"

| stats count by NoEvents

| eval Shop="A, B, C, D, E, F"

| makemv Shop delim=","

| mvexpand Shop

| eval count=NoEvents

| table Shop count

| eval {Shop}=count

| fields - count

 

The above Seemed to get me close but no cigar. I have another 6 weeks before i really need to figure this out, any help would be appreciated.  ( Id also prefer to build this in dashboard studio if that does help my problem - i am also only using static data so times are pulled in) 

Cheers

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The charting option applies to the colour used for the series. Due to the nature of your data, each shop has values for only one series so the chart will look unbalanced. Essentially, the xyseries command allows you to define which fields are to be used for the x-axis in the chart (Shop), the y-axis (NoEvents) and the different series shown in the chart (Size). The parameters to the xyseries command are really x, series, y. Or to look at it another way, the chart uses the first column of the table (produced by the xyseries command in this case) as the x-axis, the other columns for the names of the series, and the values as to be shown in the y-direction.

| xyseries Shop Size NoEvents

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The charting option applies to the colour used for the series. Due to the nature of your data, each shop has values for only one series so the chart will look unbalanced. Essentially, the xyseries command allows you to define which fields are to be used for the x-axis in the chart (Shop), the y-axis (NoEvents) and the different series shown in the chart (Size). The parameters to the xyseries command are really x, series, y. Or to look at it another way, the chart uses the first column of the table (produced by the xyseries command in this case) as the x-axis, the other columns for the names of the series, and the values as to be shown in the y-direction.

| xyseries Shop Size NoEvents

 

Altoid17
Explorer

That worked perfectly. .. wow, thank you I didn't know that function existed, I had seen it written before in others comments, but never really sure how it worked or constructed itself....I now get it from the way that you have written your response..

Thank you, I've been looking for this for months and your answer, is so simple compared to way I was trying to go and has taught me something new for the day. 

Cheers, Lou

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...