Splunk Enterprise

Color code and color changes for data

thaara
Explorer

Hi Splunkers,

I have created a pie chart and I have applied color codes to it. I have added dropdowns for my legends as well. Consider below as my scenario.

option name="charting.legend.labels">[started,failed,administratively stopped]</option>
<option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>

I got the output as expected if i choose 'ALL' in my dropdown. But If I filter any of these in the dropdown, am getting a default color which is not as expected.
Kindly help to check on this.


Also please help to get the color codes data as well.

Labels (1)
0 Karma

dpeukert
Explorer

Hi @thaara,

i tried to reproduce your problem. I created an index with the name "wine" and filled it with this data. I created the following dashboard:

<form>
  <label>Pie Chart</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="tok_quality" searchWhenChanged="true">
      <label>quality</label>
      <choice value="5">5</choice>
      <choice value="6">6</choice>
      <choice value="7">7</choice>
      <initialValue>5,6,7</initialValue>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>quality=</valuePrefix>
      <delimiter> OR </delimiter>
      <default>5,6,7</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=wine $tok_quality$
| stats count by quality</query>
          <earliest>0</earliest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="charting.legend.labels">[5,6,7]</option>
        <option name="charting.seriesColors">[B6C75A,F589AD,AAABAE]</option>
      </chart>
    </panel>
  </row>
</form>

Everything is working as expected. You might compare your dashboard to this one and see what you've done different. I hope this helps. If it doesn't help, you shall give more details about your problem like your complete dashboard code for example. And i don't know what "Also please help to get the color codes data as well." is supposed to mean.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...

Keep the Learning Going with the New Best of .conf Hub

Hello Splunkers, With .conf26 getting closer, there’s already a lot of excitement building around this year’s ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...