Splunk Search

Chart Series colors keep rearranging themselves.

ocallender
Explorer

I have a timechart area chart that shows three types of event over time ("Node up", "Node Down' and "Node Rebooted"). I want the "Node UP" series to show in green, "Node Down" in red and "Node Rebooted" in yellow. I was able to get what I wanted using: [0xFFEE33,0x00FF00,0xFF0000]

However, I find that from time to time, the colors become rearranged. "Node UP" might become yellow, "Node Down" green and "Node Rebooted" Red. Whenthis happens, I have to rearrange the colors in the charting.seriesColors until I get it right. However, after some time, the colors change again.

How can I explicitly set the colors for each series so that each type of event always has the same color?

1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

I think what you're looking for is here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization

search on the page for charting.legend.masterLegend
Color assignments (colors to series, series labeled by legend) are index based. (like an array, not a Spunk index) and they're controlled by the "Master Legend". If you have multiple charts, there will be Slave Legends as well.

There are nice clear examples of Simple XML and Advanced XML on the doc page.
This should help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

nmshaikh
Engager

I was able to use charting.fieldColors as below to hard code color based on fields/series.

    <option name="charting.fieldColors">{"average\: duration":0x6666ff,"cnt\: fail":0xff4d4d,"cnt\: success":0x80ff80}</option>
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

I think what you're looking for is here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization

search on the page for charting.legend.masterLegend
Color assignments (colors to series, series labeled by legend) are index based. (like an array, not a Spunk index) and they're controlled by the "Master Legend". If you have multiple charts, there will be Slave Legends as well.

There are nice clear examples of Simple XML and Advanced XML on the doc page.
This should help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

DominikGM
Explorer

The current reference for charting.legend.masterLegend (and all other chart configuration) is: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...