Splunk Enterprise

Color code and color changes for data

thaara
Explorer

Hi Splunkers,

I have created a pie chart and I have applied color codes to it. I have added dropdowns for my legends as well. Consider below as my scenario.

option name="charting.legend.labels">[started,failed,administratively stopped]</option>
<option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>

I got the output as expected if i choose 'ALL' in my dropdown. But If I filter any of these in the dropdown, am getting a default color which is not as expected.
Kindly help to check on this.


Also please help to get the color codes data as well.

Labels (1)
0 Karma

dpeukert
Explorer

Hi @thaara,

i tried to reproduce your problem. I created an index with the name "wine" and filled it with this data. I created the following dashboard:

<form>
  <label>Pie Chart</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_quality" searchWhenChanged="true">
      <label>quality</label>
      <choice value="5">5</choice>
      <choice value="6">6</choice>
      <choice value="7">7</choice>
      <initialValue>5,6,7</initialValue>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>quality=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>5,6,7</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=wine $tok_quality$
| stats count by quality</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="charting.legend.labels">[5,6,7]</option>
        <option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>
      </chart>
    </panel>
  </row>
</form>

Everything is working as expected. You might compare your dashboard to this one and see what you've done different. I hope this helps. If it doesn't help, you shall give more details about your problem like your complete dashboard code for example. And i don't know what "Also please help to get the color codes data as well." is supposed to mean.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...