setting colors on embed charts

[ulikabbq]

Is there a way to set the colors on a chart used for embedding? I know you can do it on a dashboard, but I can't seem to find a way to do in for a report that is turned into an embedded chart.

[jalward]

Found a clunky work around. Create the report via the GUI, set permissions, schedule it, enable embedding, etc. Then go to $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf and find the stanza for the report you just made. In there you can add lines the same way you would edit a dashboard element via XML:
colors of your bars, lines, etc: display.visualizations.charting.seriesColors = ["0x5c2fb6"]
color of the deliminations: display.visualizations.charting.foregroundColor = #000000
color of the axis and labels: display.visualizations.charting.fontColor = #000000
color of the background: display.visualizations.charting.backgroundColor = #ffffff

But, as far as I can tell, this file is not read on the fly, and you need to restart Splunk for any color changes to take effect.

[jtsetsos]

I just tried to change background color of a report that displays a chart using the method described as above and it doesn't work, well it fails to load the settings when I restart splunk with the following errors, note I have also tried with quotes and without and also in ["0xffffff"] and ["#ffffff"] and [#ffffff], none of the options work:

    Checking conf files for problems...
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 31: display.visualizations.charting.backgroundColor  (value:  "#000000").
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 32: display.visualizations.charting.fontColor  (value:  "#ffffff").
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 33: display.visualizations.charting.foregroundColor  (value:  "#ffffff").

I checked the documentation found at:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Savedsearchesconf#Display_Formatting_Option...

And there is no mention of these specific settings anywhere in this document, not even in the deprecated section of the document.

errr uhmmmm so what gives here?

Is it possible to change the background/foreground colors of an embedded report that displays a chart or not?

I'd like a black background with white text foreground, is this at all possible?

Kind Regards
Jim

[mehala12]

Awesome!! It works 🙂

[gesa_behrens]

great! I was looking for that for a while. I only hope it will not be overwritten after next change to the search

[jalward]

Saving a search as a report. On the report I set a cron schedule, allow read permissions, then enable embedding. Splunk generates an iframe tag for export.

[briancronrath]

Can you post an example of how you are embedding the chart?

[jalward]

Ditto. Would love to change the colors on embedded reports.

[cljs0280]

Me too! Anyone knows how to solve this problem?