Dashboards & Visualizations

Why are the colors in my bar chart not changing as desired?

rkaakaty
Path Finder

So I am trying to change the colors of each bar value. I am not sure why it isnt' working.

Here is my code:

<dashboard>
  <label>Type_Panel</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID
| stats count by TYPE</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.fieldColors">
         {"CONFIRMED": 0xFF0000, "Potential": 0xF87217}
       </option>
      </chart>
    </panel>
  </row>
</dashboard>

Here is the picture of my current bar graph when I save that code:

alt text

0 Karma

cmerriman
Super Champion

Instead of the fieldColors option, try using the seriesColors option.

0 Karma

somesoni2
Revered Legend

The fieldColors expect that "CONFIRMED" and "Potential" are column/field names not values. Your stats command has column/field name as TYPE. Try this search

eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID | eval temp=1
 | chart count by temp TYPE | fields - temp

OR

 eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID
 | stats count(eval(TYPE="CONFIRMED")) as CONFIRMED count(eval(TYPE="Potential")) as Potential

rkaakaty
Path Finder

these options did not work for me

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...