changing bars colors by a string value of a field

[matansocher]

Hi,

I have a simple bar chart that sums a number("SLOC") by another field("file").
each file has another field that describes it - "sloc_type" - and I want to change the files bars colors by the "sloc_type" field.

example to the chart now:

the "sloc_type" field has only 2 options: rtl, verif.

I need the files bar to be in a specific color, in order to separate them by their "sloc_type"

Thanks

[niketn · Accepted solution]

try creating a Stacked bar chart with the following query:

 index=testeda_p groupID=sloc_data 
 | search project=Periph core=ipa core_ver=4.2.0
 | chart sum(sloc) as SLOC over file by sloc_type
 | sort -SLOC
 | head 10

[matansocher]

thanks. it really got me closer to what I needed

[niketn]

@matansocher, glad it helped! Please let us know if something is still not as expected or if you need further help 🙂

[matansocher]

my search:

index=testeda_p groupID=sloc_data 
| search project=Periph core=ipa core_ver=4.2.0
| stats sum(sloc) as SLOC by file
| sort -SLOC
| head 10