I want to customize bar chart? Can someone tell what I am doing wrong in this xml?

[karu0711]

can someone tell me what am I doing wrong in this xml?

<dashboard>
  <label>test Veracode</label>
  <row>
    <panel>
      <title>Severity by flaw</title>
      <chart>
        <search>
          <query>index="veracode_test" sourcetype="Veracode_scan" | lookup Veracode.csv findings{}.severity | stats count by Severity 
| append 
    [| inputlookup Veracode.csv | fields Severity 
    | stats count by Severity | eval count = 0]
| stats max(count) as Total by Severity
| eval sorter = case(Severity="Very High", 5, Severity="High", 4, Severity="medium", 3, Severity="Low",2, Severity="Very Low",1,1==1,99)
| sort + sorter
| fields - sorter</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"Very High":#e60000,"High":ff0000,"meidum":#ff8000,
"Low":#ffbf00,"Very Low":#ffff00 }</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>

[richgalloway]

What are you trying to do?  How do those results not meet expectations?

[karu0711]

I want the bar chart to display in the color I defined. but I am getting default blue color. 

[richgalloway]

In the charting.fieldColors option, specify color codes in hex by prefixing the numbers with "0x" rather than "#".

Also, make sure the field values are correct in the fieldColors list ("meidum").

[karu0711]

I change but still no color change.

[richgalloway]

I'm stumped.  I can find old postings that say this works, but it's not working for me.  I even tried on an 8.1 system I have.

I made the following change and the graph changed to green, which tells me Splunk is looking at the count field for coloring rather than the Severity field.  I can't figure out how to change that.

<option name="charting.fieldColors">{"Very High":0xFF0000,"High":0xFF9900,"Medium":0x0066FF,"Low":0xC4C4C0,"Very Low":0xBEEF00,"count":0x00FF00}</option>