coloring coloumn chart

[smolcj]

Hi all,
my search is like index=main | chart count by severity
and i am getting a chart like
count in y axis, error and info in x axis and the color of both columns are blue
i modified the search in view as
index=main | chart count by severity| eval red=if(severity=="ERROR",1,0)|eval green = if(severity=="INFO",1,0)
and charting option to

{"red":0xFF0000,"green":0x00FF00}

but i am getting a wiered chart with top border color as i specified and fill color as count color, also i am not able to drill down it.
please help
Thank you

[smolcj]

dashboard is in simple xml, it have a dropdown box listing sources and a chart showing the severity

[lguinn2 · Accepted solution]

Here is an answer that may help: Change chart bar color based on data value

Note that this technique leverages a side-effect of the stats command; it does not work with the chart command.

[lguinn2]

The automatic drilldown will not work, because the search has eval commands following the stats command:

sourcetype=mysourcetype AND searchstuffforerrors | stats count by host
| eval redCount = if(count>20,count,0)
| eval yellowCount = if(count<=20 AND count>15,count,0)
| eval greenCount = if(count<=15, count, 0)
| fields - count

You should be able to include an explicit drill-down in the XML, starting with Splunk 5.0. Look here for more info on drill-down: http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Dynamicdrilldownindashboardsandforms

[smolcj]

is it possible to use an explicit drill down option using
if so /app/search/flashtimeline?q=source=$sources$
here sources is my dropdown box result, how to create a query supporting this drill down
please help

[smolcj]

Thanks lguinn, it worked well, but i am not able to drill down from the chart, befor changing the color i was able to . but not now,, why?
"PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"
this is the error
please help

[jonuwz]

can you post the complete XML for the dashboard ?

[smolcj]

i tried with this option
charting.chart.fieldColors
but no change, drilldown is also not happening

[jonuwz]

pretty sure it should be charting.chart.fieldColors not charting.fieldColors