Dashboards & Visualizations

Splunk Dashboard Studio: Why is Setting graph colors with fieldColors not working?

triptraptresko
Explorer

Trying to set graph colors with fieldColors in options, in Dashboard Studio.

Tried to set them in both dataSources and Visualizations to no avail. What am i doing wrong?

Tested on Splunk Cloud Version: 8.2.2203.2.

Whole code for dashboard below

{
    "dataSources": {
        "ds_sourcetype": {
            "type""ds.search",
            "options": {
                "query""index=_internal _sourcetype IN ( splunk_web_access, splunkd_access)\n| timechart count by _sourcetype",
                "fieldColors": {
                    "splunk_web_access""#FF0000",
                    "splunkd_access""#0000FF"
                }
            },
            "name""Search_1"
        }
    },
    "visualizations": {
        "viz_sourcetype": {
            "type""splunk.line",
            "options": {
                "fieldColors": {
                    "splunk_web_access""#FF0000",
                    "splunkd_access""#0000FF"
                },
                "yAxisAbbreviation""auto",
                "y2AxisAbbreviation""auto",
                "showRoundedY2AxisLabels"false,
                "legendTruncation""ellipsisMiddle",
                "showY2MajorGridLines"true,
                "xAxisLabelRotation"0,
                "xAxisTitleVisibility""show",
                "yAxisTitleVisibility""show",
                "y2AxisTitleVisibility""show",
                "yAxisScale""linear",
                "showOverlayY2Axis"false,
                "nullValueDisplay""gaps",
                "dataValuesDisplay""off",
                "showSplitSeries"false,
                "showIndependentYRanges"false,
                "legendMode""standard",
                "legendDisplay""right",
                "lineWidth"2,
                "backgroundColor""#ffffff"
            },
            "dataSources": {
                "primary""ds_sourcetype"
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type""input.timerange",
            "options": {
                "token""global_time",
                "defaultValue""-24h@h,now"
            },
            "title""Global Time Range"
        }
    },
    "layout": {
        "type""grid",
        "options": {},
        "structure": [
            {
                "item""viz_sourcetype",
                "type""block",
                "position": {
                    "x"0,
                    "y"0,
                    "w"1200,
                    "h"400
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    },
    "title""dashboard_studio_test",
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest""$global_time.latest$",
                        "earliest""$global_time.earliest$"
                    }
                }
            }
        }
    }
}
Labels (2)
0 Karma

mpalarchio
Splunk Employee
Splunk Employee

Hi @triptraptresko !

If you were using the older viz.line type visualization, you would be correct about using the option fieldColors - however, you're using the newer splunk.line type, which uses an option called seriesColorsByField to accomplish the same thing. 

Try swapping the name of the options and it should work!

 

 

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...