Splunk Enterprise

Color code and color changes for data

thaara
Explorer

Hi Splunkers,

I have created a pie chart and I have applied color codes to it. I have added dropdowns for my legends as well. Consider below as my scenario.

option name="charting.legend.labels">[started,failed,administratively stopped]</option>
<option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>

I got the output as expected if i choose 'ALL' in my dropdown. But If I filter any of these in the dropdown, am getting a default color which is not as expected.
Kindly help to check on this.


Also please help to get the color codes data as well.

Labels (1)
0 Karma

dpeukert
Explorer

Hi @thaara,

i tried to reproduce your problem. I created an index with the name "wine" and filled it with this data. I created the following dashboard:

<form>
  <label>Pie Chart</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_quality" searchWhenChanged="true">
      <label>quality</label>
      <choice value="5">5</choice>
      <choice value="6">6</choice>
      <choice value="7">7</choice>
      <initialValue>5,6,7</initialValue>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>quality=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>5,6,7</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=wine $tok_quality$
| stats count by quality</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="charting.legend.labels">[5,6,7]</option>
        <option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>
      </chart>
    </panel>
  </row>
</form>

Everything is working as expected. You might compare your dashboard to this one and see what you've done different. I hope this helps. If it doesn't help, you shall give more details about your problem like your complete dashboard code for example. And i don't know what "Also please help to get the color codes data as well." is supposed to mean.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...

55 Days to Go: Secure Your Seat at Splunk University in Denver

Your .conf26 Experience Starts Before Opening Keynote  If Denver is known for its mile-high elevation, Splunk ...

(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...

This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...