Why are my Pie Chart colors correct when running a search on its own, but not when loaded in a panel on a dashboard?

[daviduslan]

Hello,

I have a pie chart in a dashboard that, when loaded in its own search, looks like this (correct): http://puu.sh/jYFMd/0d02be5455.png.

Prior to this morning, every time it's loaded on the dashboard, it's been fine. However, now it looks like this (broken): http://puu.sh/jYFQJ/94ffcab70c.png.

Has anyone experienced this issue / know what's going on?

Thanks for your help!

[frobinson_splun · Accepted solution]

Hi again, @daviduslan,
Our team mentioned that, depending on how many other charts there are in the dashboard, color options for a given chart may be affected. To review or change the chart color options, take a look at these two Simple XML elements for your charts:
charting.fieldColors
charting.seriesColors

You can adjust the array of available color options or hard-code certain field colors using these options.

Here is some documentation on charting Simple XML, including these two options:
http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/ChartConfigurationReference

Hope that this helps! Please let me know if not and we can continue discussing.

All the best,
@frobinson_splunk

[daviduslan]

So if I'm understanding you correctly, on a dashboard with lots of charts, you can run out of colors and that the fix for this is to manually set the colors for reports that are affected?

edit:
Thanks @frobinson_splunk, this solution did indeed work. However, I think that the need for this as a fix is rather silly.

<option name="charting.fieldColors">{"iOS": 0x0000ff, "Android": 0xff0000}</option>

[frobinson_splun]

Thanks for the feedback, @daviduslan! I'll relay it to our team.

[frobinson_splun]

Hi @daviduslan,
I'm a tech writer here at Splunk and I work on dashboard docs. I'd like to help with your question. What version of the software are you using? Did anything else change with the dashboard or search between yesterday and today?

I can consult with our engineering team about this.

Thanks,
@frobinson_splunk

[daviduslan]

I'm running Splunk Version 6.2.3 (build 264376). This dashboard has been unchanged for the last couple weeks AND there is another pie chart on the dashboard that displays properly (http://puu.sh/jYI1V/7e833851e0.png)

[woodcock]

Make sure that you capture the tabluar data that drove this pie chart. I am sure that this is an edge-case bug that depends on the data being just exactly what it is to make it happen. Capture the data while it is still happening and open a support case.