Dashboards & Visualizations

color a pie chart slice

autoteam
Engager

Hello, 

I have a pie chart that shows me the count of all the alerts I get on my system, stats by severity.

Because I couldn't find a way to show the count (only the percentage) then I changed the name so it will contain both the severity name and the count (used eval function).

before I changed the name I used charting.fieldcolores to set a specific color to each severity(slice), now that the name constantly changing because the count is changing I wasn't able to set a color to each slice.

I tried using charting.seriescolors but when I use that I cant determine that the critical severity will always get a red color and the warning gets orange and so... because the color is not set to a specific slice. 

I wanted to ask if there is a way I can set the colors regularly to a name when I don't have the full name of the slice, maybe using a (*) like- "Critical*" and then the slice that contain the word critical will always color in red?

If it is not possible, is there a way to show the count and not the percentage! without using eval and changing the slice name?

 

all answers will help!

thanks!!!

 

Labels (2)
0 Karma
1 Solution

autoteam
Engager

It worked! thank you so much!

0 Karma

autoteam
Engager

Hi,

As I understand from the answer I still have a problem since I can't ensure that  all the labels will stay present because when the value is 0 it is absent. this is one of the things that bothered me with the seriescolor...

In addition I want to keep the count in the label name not to change it. I saw they used eval in the answer.

what can I do with those cases?

 

thanks again!!!

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
When you are using seriesColors it's not matter what labels you have. Only thing what you must ensure is the order and amount of those fields. That must be always fixed.
r. Ismo
0 Karma

autoteam
Engager

Ok, so how can I ensure that?

I tried setting the colors in the seriescolors by the order of the labels but sometimes the changed when I had a value of 0 and that's when my problem started...

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

From @niketn 's response:

The command after |append ensure all series are always present and in the same sequence so that seriesColors can be applied. While testing you can randomly take out specific series like status=\"Progress\",count=10; to test that it creates a Process row with 0 count and 0%. Please try with seriesColors and confirm!

Can you do it like this?

r. Ismo 

0 Karma

autoteam
Engager

I will try first thing first on Sunday an let you know!

thank you so much!! 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...