Splunk Search

Chart Color Assignment (seriesColors) Not Working Properly

David
Splunk Employee
Splunk Employee

This is the first time I've tried this, so I'm not sure if I've got something wrong. I'm trying to assign static colors to a large number of similar charts on a dashboard. I have in my config:

<param name="charting.legend.labels">[FieldA,FieldB,"Field C",FieldD,FieldE,FieldF,"Field G"]</param>
<param name="charting.seriesColors">[0x00FF00,0xFF0000,0x0000FF,0xFFFF00,0xFF00FF,0x00FFFF,0x000000]</param>

(ugly colors chosen as they're easy to recognize). I've verified that if I switch "Field C" and FieldD, they switch in the legend. The problem I'm seeing is that FieldD is green, FieldE is Red, FieldF is Blue, etc. It appears that instead of starting with FieldA=0x00FF00 and moving down the list, it's offsetting so that FieldD=0x00FF00 and then it moves down the list in order.

There's an obvious workaround (just rotate the colors around), but I'm curious as to whether this is a bug or some config issue on my part.

(Example based around: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedCharting)

Tags (1)
1 Solution

jgatt
Splunk Employee
Splunk Employee

There is one more parameter required to make this work when you have multiple charts on a page - setting the legend.masterLegend property to null or empty string:

<param name="charting.legend.masterLegend"></param>

This is discussed near the end of the "Chart colors" section. All legends for all charts in a view are connected to a common "master legend" so that their colors are synchronized. To ensure that your labels align with your colors, you need to detach the legend from the master legend.

Also, if you're using a version of Splunk below 4.2, the quotes you have around Field C and Field G will be interpreted as part of the label name. If that's not your intention, removing the quotes will give you the desired behavior.

Now, if you are using 4.2+, you can disregard all of this because, in addition to supporting quotes, spaces, etc. in complex values, mapping colors to field names is a whole lot easier:

<param name="charting.fieldColors">{ "FieldA": 0x00FF00, "FieldB": 0xFF0000 }</param>

This new feature (and other charting improvements in 4.2) is still in the process of being documented.

View solution in original post

jgatt
Splunk Employee
Splunk Employee

There is one more parameter required to make this work when you have multiple charts on a page - setting the legend.masterLegend property to null or empty string:

<param name="charting.legend.masterLegend"></param>

This is discussed near the end of the "Chart colors" section. All legends for all charts in a view are connected to a common "master legend" so that their colors are synchronized. To ensure that your labels align with your colors, you need to detach the legend from the master legend.

Also, if you're using a version of Splunk below 4.2, the quotes you have around Field C and Field G will be interpreted as part of the label name. If that's not your intention, removing the quotes will give you the desired behavior.

Now, if you are using 4.2+, you can disregard all of this because, in addition to supporting quotes, spaces, etc. in complex values, mapping colors to field names is a whole lot easier:

<param name="charting.fieldColors">{ "FieldA": 0x00FF00, "FieldB": 0xFF0000 }</param>

This new feature (and other charting improvements in 4.2) is still in the process of being documented.

View solution in original post

sandipan11
Path Finder

Thank you for you answer. It is working. but I have another problem. When I have space in legend name like [US(%),Europe(%),Latin America(%)] but it creating 5 labels - US(%),Europe(%),Latin, America(%), Latin America(%). I guess it is happen for space in 'Latin America'. Is there any solution for this?

0 Karma

sandipan11
Path Finder

I got the solution. I keep each entry in double quote like ["US(%)","Europe(%)","Latin America(%)"]

0 Karma

0waste_splunk
Communicator

FYI: charting.fieldColors doesn't work on pie chart using JSChart.

0 Karma

David
Splunk Employee
Splunk Employee

Excellent -- that's good to know, and thanks for pointing out the part about charting.legend.masterLegend that I'd missed in the documentation.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!