Dashboards & Visualizations

setting colors on embed charts

ulikabbq
Path Finder

Is there a way to set the colors on a chart used for embedding? I know you can do it on a dashboard, but I can't seem to find a way to do in for a report that is turned into an embedded chart.

Tags (3)

jalward
Explorer

Found a clunky work around. Create the report via the GUI, set permissions, schedule it, enable embedding, etc. Then go to $SPLUNK_HOME/etc/apps/search/local/savedsearches.conf and find the stanza for the report you just made. In there you can add lines the same way you would edit a dashboard element via XML:
colors of your bars, lines, etc: display.visualizations.charting.seriesColors = ["0x5c2fb6"]
color of the deliminations: display.visualizations.charting.foregroundColor = #000000
color of the axis and labels: display.visualizations.charting.fontColor = #000000
color of the background: display.visualizations.charting.backgroundColor = #ffffff

But, as far as I can tell, this file is not read on the fly, and you need to restart Splunk for any color changes to take effect.

jtsetsos
Engager

I just tried to change background color of a report that displays a chart using the method described as above and it doesn't work, well it fails to load the settings when I restart splunk with the following errors, note I have also tried with quotes and without and also in ["0xffffff"] and ["#ffffff"] and [#ffffff], none of the options work:

    Checking conf files for problems...
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 31: display.visualizations.charting.backgroundColor  (value:  "#000000").
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 32: display.visualizations.charting.fontColor  (value:  "#ffffff").
            Invalid key in stanza [PieChartByCountry_Report] in /opt/splunk/etc/apps/search/local/savedsearches.conf, line 33: display.visualizations.charting.foregroundColor  (value:  "#ffffff").

I checked the documentation found at:

https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Savedsearchesconf#Display_Formatting_Option...

And there is no mention of these specific settings anywhere in this document, not even in the deprecated section of the document.

errr uhmmmm so what gives here?

Is it possible to change the background/foreground colors of an embedded report that displays a chart or not?

I'd like a black background with white text foreground, is this at all possible?

Kind Regards
Jim

0 Karma

mehala12
Explorer

Awesome!! It works 🙂

0 Karma

gesa_behrens
Path Finder

great! I was looking for that for a while. I only hope it will not be overwritten after next change to the search

0 Karma

jalward
Explorer

Saving a search as a report. On the report I set a cron schedule, allow read permissions, then enable embedding. Splunk generates an iframe tag for export.

0 Karma

briancronrath
Contributor

Can you post an example of how you are embedding the chart?

0 Karma

jalward
Explorer

Ditto. Would love to change the colors on embedded reports.

0 Karma

cljs0280
New Member

Me too! Anyone knows how to solve this problem?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...