Rules for Color in Pie Chart

[Zakary_n]

I'd like to create rules when it comes to color with my Pie Chart.

Problem is, there are variable in my label names, for example I have things like "USA [1990]" , "USA [2016]", "USA [2018]"

I'd like all the "USA" to be the same color.

So I create an option.name looking like this :

option name="charting.fieldColors"
{"%USA%":0xFF0000}
/option

But it won't work. Do you guys have any idea how to achieve that ?

[Zakary_n · Accepted solution]

Unfortunatly, nothing to be done in the current state of Splunk to solve this.

[VatsalJagani]

Hi @Zakary_n,

Unfortunately % will not work in charting option fieldColors. So one way that you can achieve is that merge all USA with search only with eval and then add drilldown in the pie chart to check data separated by years.

Hope this helps!!!