Change color of stats count visualization

[esmonder]

Hi I am new to splunk.

I am trying to do a bar chart viz and trying to color each sourcetype by a color but havent been successful
this is my search index=main| stats count by severity

I tried the below in xml but my data are still all the same color
<option name="charting.fieldColors"> {"high":0xFF0000, "medium":0xFFFF00, "low":0x00FF00</option>

[esmonder · Accepted solution]

<chart>
        <search>
          <query>index=main |stats count(eval(severity="high")) as red count(eval(severity="medium")) as yellow count(eval(severity="low")) as green by severity</query>
          <!--query> index= main | stats count by sourcetype</query-->
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.fieldColors"> {"red":0xFF0000, "green":0x00FF00, "yellow":0xFFFF00}</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>

found the answer through looking at some other answers here hehe
https://answers.splunk.com/answers/547760/why-are-the-colors-in-my-bar-chart-not-changing-as.html

[kmorris_splunk]

I believe you need to use seriesColors instead of fieldColors:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization

[esmonder]

didn't work with seriesColors