Chart Color Assignment (seriesColors) Not Working Properly

[David]

This is the first time I've tried this, so I'm not sure if I've got something wrong. I'm trying to assign static colors to a large number of similar charts on a dashboard. I have in my config:

<param name="charting.legend.labels">[FieldA,FieldB,"Field C",FieldD,FieldE,FieldF,"Field G"]</param>
<param name="charting.seriesColors">[0x00FF00,0xFF0000,0x0000FF,0xFFFF00,0xFF00FF,0x00FFFF,0x000000]</param>

(ugly colors chosen as they're easy to recognize). I've verified that if I switch "Field C" and FieldD, they switch in the legend. The problem I'm seeing is that FieldD is green, FieldE is Red, FieldF is Blue, etc. It appears that instead of starting with FieldA=0x00FF00 and moving down the list, it's offsetting so that FieldD=0x00FF00 and then it moves down the list in order.

There's an obvious workaround (just rotate the colors around), but I'm curious as to whether this is a bug or some config issue on my part.

(Example based around: http://www.splunk.com/base/Documentation/latest/Developer/AdvancedCharting)

[jgatt · Accepted solution]

There is one more parameter required to make this work when you have multiple charts on a page - setting the legend.masterLegend property to null or empty string:

<param name="charting.legend.masterLegend"></param>

This is discussed near the end of the "Chart colors" section. All legends for all charts in a view are connected to a common "master legend" so that their colors are synchronized. To ensure that your labels align with your colors, you need to detach the legend from the master legend.

Also, if you're using a version of Splunk below 4.2, the quotes you have around Field C and Field G will be interpreted as part of the label name. If that's not your intention, removing the quotes will give you the desired behavior.

Now, if you are using 4.2+, you can disregard all of this because, in addition to supporting quotes, spaces, etc. in complex values, mapping colors to field names is a whole lot easier:

<param name="charting.fieldColors">{ "FieldA": 0x00FF00, "FieldB": 0xFF0000 }</param>

This new feature (and other charting improvements in 4.2) is still in the process of being documented.

[sandipan11]

Thank you for you answer. It is working. but I have another problem. When I have space in legend name like [US(%),Europe(%),Latin America(%)] but it creating 5 labels - US(%),Europe(%),Latin, America(%), Latin America(%). I guess it is happen for space in 'Latin America'. Is there any solution for this?

[sandipan11]

I got the solution. I keep each entry in double quote like ["US(%)","Europe(%)","Latin America(%)"]

[0waste_splunk]

FYI: charting.fieldColors doesn't work on pie chart using JSChart.

[David]

Excellent -- that's good to know, and thanks for pointing out the part about charting.legend.masterLegend that I'd missed in the documentation.