Splunk Search

How can I specify the constant colors to field values in a pie chart ?

pavanae
Builder

I have a splunk query which ends as follows

my_query | stats count by field_A | eval field_A=field_A + "," + count

As per the above my results are as follows

field_A count
ABC,45 45
DEF,60 60

Now I have displayed the above in a pie chart so that I can see each slice name and their count like below

alt text

Now All I'm trying to do is assign some default colors to the pie chart but I only know how to assign a default color if the field values of field_A are default like below if they are default

alt text

But here the case is different the field values will get changed since the count will get changed like below since the count is not constant where ABC,DEF,GHI are constant.

ABC*,count*
DEF*,count*
GHI*,count*

Now here in this case how can I specify the constant colors to the non-constant field names in charting.fieldColors?

salbro
Path Finder

I have the same issue as you, instead I use a dash and the value. As @niketnilay has stated, seriesColors is the way to go. I applied this to my chart HTML, and used an array of the colors I wanted to use; I only lost some granularity in assignment.

<option name="charting.seriesColors">[0x4F2984, 0xFFDD00]</option>
0 Karma

niketn
Legend

@pavanae since you do not have field name constant, as far as you can keep the all the values for field_A always present (for example through fillnull or lookup) in the search result and that too in the same sequence (for example through sort field_A), you can use seriesColors instead of fieldColors. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#General_chart_pr...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...