Splunk Enterprise

Color code and color changes for data

thaara
Explorer

Hi Splunkers,

I have created a pie chart and I have applied color codes to it. I have added dropdowns for my legends as well. Consider below as my scenario.

option name="charting.legend.labels">[started,failed,administratively stopped]</option>
<option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>

I got the output as expected if i choose 'ALL' in my dropdown. But If I filter any of these in the dropdown, am getting a default color which is not as expected.
Kindly help to check on this.


Also please help to get the color codes data as well.

Labels (1)
0 Karma

dpeukert
Explorer

Hi @thaara,

i tried to reproduce your problem. I created an index with the name "wine" and filled it with this data. I created the following dashboard:

<form>
  <label>Pie Chart</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_quality" searchWhenChanged="true">
      <label>quality</label>
      <choice value="5">5</choice>
      <choice value="6">6</choice>
      <choice value="7">7</choice>
      <initialValue>5,6,7</initialValue>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>quality=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>5,6,7</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=wine $tok_quality$
| stats count by quality</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="charting.legend.labels">[5,6,7]</option>
        <option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>
      </chart>
    </panel>
  </row>
</form>

Everything is working as expected. You might compare your dashboard to this one and see what you've done different. I hope this helps. If it doesn't help, you shall give more details about your problem like your complete dashboard code for example. And i don't know what "Also please help to get the color codes data as well." is supposed to mean.

0 Karma
Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...