Dashboards & Visualizations

setting colors on embed charts

Path Finder

Is there a way to set the colors on a chart used for embedding? I know you can do it on a dashboard, but I can't seem to find a way to do in for a report that is turned into an embedded chart.

Tags (3)


Found a clunky work around. Create the report via the GUI, set permissions, schedule it, enable embedding, etc. Then go to $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf and find the stanza for the report you just made. In there you can add lines the same way you would edit a dashboard element via XML:
colors of your bars, lines, etc: display.visualizations.charting.seriesColors = ["0x5c2fb6"]
color of the deliminations: display.visualizations.charting.foregroundColor = #000000
color of the axis and labels: display.visualizations.charting.fontColor = #000000
color of the background: display.visualizations.charting.backgroundColor = #ffffff

But, as far as I can tell, this file is not read on the fly, and you need to restart Splunk for any color changes to take effect.


I just tried to change background color of a report that displays a chart using the method described as above and it doesn't work, well it fails to load the settings when I restart splunk with the following errors, note I have also tried with quotes and without and also in ["0xffffff"] and ["#ffffff"] and [#ffffff], none of the options work:

    Checking conf files for problems...
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 31: display.visualizations.charting.backgroundColor  (value:  "#000000").
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 32: display.visualizations.charting.fontColor  (value:  "#ffffff").
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 33: display.visualizations.charting.foregroundColor  (value:  "#ffffff").

I checked the documentation found at:


And there is no mention of these specific settings anywhere in this document, not even in the deprecated section of the document.

errr uhmmmm so what gives here?

Is it possible to change the background/foreground colors of an embedded report that displays a chart or not?

I'd like a black background with white text foreground, is this at all possible?

Kind Regards

0 Karma


Awesome!! It works 🙂

0 Karma

Path Finder

great! I was looking for that for a while. I only hope it will not be overwritten after next change to the search

0 Karma


Saving a search as a report. On the report I set a cron schedule, allow read permissions, then enable embedding. Splunk generates an iframe tag for export.

0 Karma


Can you post an example of how you are embedding the chart?

0 Karma


Ditto. Would love to change the colors on embedded reports.

0 Karma

New Member

Me too! Anyone knows how to solve this problem?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...