Chart Series colors keep rearranging themselves.

[ocallender]

I have a timechart area chart that shows three types of event over time ("Node up", "Node Down' and "Node Rebooted"). I want the "Node UP" series to show in green, "Node Down" in red and "Node Rebooted" in yellow. I was able to get what I wanted using: [0xFFEE33,0x00FF00,0xFF0000]

However, I find that from time to time, the colors become rearranged. "Node UP" might become yellow, "Node Down" green and "Node Rebooted" Red. Whenthis happens, I have to rearrange the colors in the charting.seriesColors until I get it right. However, after some time, the colors change again.

How can I explicitly set the colors for each series so that each type of event always has the same color?

[nmshaikh]

I was able to use charting.fieldColors as below to hard code color based on fields/series.

    <option name="charting.fieldColors">{"average\: duration":0x6666ff,"cnt\: fail":0xff4d4d,"cnt\: success":0x80ff80}</option>

[rsennett_splunk · Accepted solution]

I think what you're looking for is here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization

search on the page for charting.legend.masterLegend
Color assignments (colors to series, series labeled by legend) are index based. (like an array, not a Spunk index) and they're controlled by the "Master Legend". If you have multiple charts, there will be Slave Legends as well.

There are nice clear examples of Simple XML and Advanced XML on the doc page.
This should help.

[DominikGM]

The current reference for charting.legend.masterLegend (and all other chart configuration) is: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference