Why did my pie charts randomly start using the darkest colors for each slice? How can I make my pie charts use the lighter more visible colors?

[zd00191]

Pie charts randomly started using the html colors. I have placed a copy of the xml below.

<chart>
          <title>Running Jobs: $System$-$FunctionalArea$</title>
          <searchString>index=ko_autosys      sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" JOB_NAME="*" eventtype=autosys_running_jobs System="$System$" |stats count by FUNCTIONAL_AREA_NAME</searchString>
          <earliestTime>$Time.earliest$</earliestTime>
          <latestTime>$Time.latest$</latestTime>
          <option name="charting.axisTitleX.visibility">visible</option>
          <option name="charting.axisTitleY.visibility">visible</option>
          <option name="charting.axisX.scale">linear</option>
          <option name="charting.axisY.scale">linear</option>
          <option name="charting.chart">pie</option>
          <option name="charting.chart.nullValueMode">gaps</option>
          <option name="charting.chart.sliceCollapsingThreshold">0.00</option>
          <option name="charting.chart.stackMode">default</option>
          <option name="charting.chart.style">shiny</option>
          <option name="charting.drilldown">all</option>
          <option name="charting.layout.splitSeries">0</option>
          <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
          <option name="charting.legend.placement">right</option>
        </chart>

[MuS · Accepted solution]

Hi zd00191,

you can set the colors using the charting.seriesColors to assign a series of colors or use the charting.fieldColors option like this:

<dashboard>
  <row>
    <chart>
      <searchString>index=_internal source=*access* | chart count by status</searchString>
      <earliestTime>-60m@m</earliestTime>
      <latestTime>now</latestTime>
      <option name="charting.chart">pie</option>
      <option name="charting.fieldColors">{200:0x00ff00,201:0x33ff00,204:0x66ff00,303:0xffaa00,304:0xffff00,404:0xff0000}</option>
    </chart>
  </row>
</dashboard>

to set a different colour based on the value of the status field in this example.
See the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization#Chart_colors

cheers, MuS