Dashboards & Visualizations

Pie chart colors mess up when other field is present


I am using the line

<option name="charting.fieldColors">{"SUCCESS": 0x00FF00, "FAIL":0xFF0000}</option>

with no problems, however when I use

 <option name="charting.fieldColors">{"OK": 0x00FF00}</option>  

in a seperate graph it has problem, because the values that are not "OK" are is grouped into others().
If I put other value from 0.01 to 0 in XML, it fixes it, however I want the other to be there.
How can I have other and have the OK field be green?

Tags (2)
0 Karma


The charting.fieldColors works great when you know all the names of the fields, but isn't always your best choice when you don't the field names in advance. Try one of these two options:

Option 1: Use seriesColors instead of fieldColors, like this

<option name="charting.seriesColors">[0x00FF00,0x999999,0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f]</option>  

Which should make the first field green, the second field gray, and then the next fields (if any) the standard Splunk colors: blue, yellow, etc.

Option 2: Or you could use fieldColors, but name all the fields

<option name="charting.fieldColors">{"OK": 0x00FF00, "Other": 0x999999}</option>  

To give the Other field a specific color. (You may need to change the capitalization of the field name to match the pie chart output.)

0 Karma

Splunk Employee
Splunk Employee

what does the data look like in the search with "others"? can you show post a screenshot of the broken pie?

- MattyMo
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...