So I am trying to change the colors of each bar value. I am not sure why it isnt' working.
Here is my code:
<dashboard>
<label>Type_Panel</label>
<row>
<panel>
<chart>
<search>
<query>eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID
| stats count by TYPE</query>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="charting.fieldColors">
{"CONFIRMED": 0xFF0000, "Potential": 0xF87217}
</option>
</chart>
</panel>
</row>
</dashboard>
Here is the picture of my current bar graph when I save that code:
Instead of the fieldColors option, try using the seriesColors option.
The fieldColors expect that "CONFIRMED" and "Potential" are column/field names not values. Your stats command has column/field name as TYPE. Try this search
eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID | eval temp=1
| chart count by temp TYPE | fields - temp
OR
eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID
| stats count(eval(TYPE="CONFIRMED")) as CONFIRMED count(eval(TYPE="Potential")) as Potential
these options did not work for me