Splunk Search

How do I change the color of a pie graphic for each unique value?

bruno_eduardo
Path Finder

I have a Risk field with this possible values (Critical, High, Medium, Low) and I want to be red when critical, high is purple, yellow medium and green low.

I would like to do this in the query itself, if it is not possible , let´s do it on xml!!!

Here is the xml:

<chart>
  <title>Severidade - Vulnerabilidades Vencidas</title>
  <searchString>index="patches" earliest=@d latest=now  Estado=Vencida OR Estado=Expired NOT Descripci_xF3n="EHT*" NOT Title="EHT*" NOT GrupoName2="DS - PROJETOS"  | stats count by Risk</searchString>
  <earliestTime>0</earliestTime>
  <latestTime>now</latestTime>
  <option name="charting.axisTitleX.visibility">visible</option>
  <option name="charting.axisTitleY.visibility">visible</option>
  <option name="charting.axisX.scale">linear</option>
  <option name="charting.axisY.scale">linear</option>
  <option name="charting.chart">pie</option>
  <option name="charting.chart.nullValueMode">gaps</option>
  <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
  <option name="charting.chart.stackMode">default</option>
  <option name="charting.chart.style">minimal</option>
  <option name="charting.drilldown">all</option>
  <option name="charting.layout.splitSeries">0</option>
  <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
  <option name="charting.legend.placement">right</option>
  <option name="wrap">true</option>
  <option name="rowNumbers">false</option>
  <option name="dataOverlayMode">none</option>
  <option name="drilldown">cell</option>

Thanks in advance

Tags (4)
0 Karma
1 Solution

tom_frotscher
Builder

Hi, you can use the option charting.seriesColor.

See the second example for chart colors in this part of the documentation for your usecase: Link

View solution in original post

tom_frotscher
Builder

Hi, you can use the option charting.seriesColor.

See the second example for chart colors in this part of the documentation for your usecase: Link

jeremiahc4
Builder

A slightly less blinding green & red (more Christmas'y)

<option name="charting.legend.labels">["Bad Stuff","Good Stuff"]</option>
<option name="charting.seriesColors">[0x088A08,0xDF0101]</option>

Oddly I am confused on why the order of the labels doesn't match the order of the colors? I just copied that directly from a dashboard (redacting only the verbage) and it shows "Bad Stuff" as 0xDF0101 (slightly dark red).

0 Karma

jeremiahc4
Builder

And I'm even further confused as I just looked at another panel on the same dashboard which shows a different order being picked up.

<option name="charting.legend.labels">["Other Bad Stuff","Other Good Stuff"]</option>
<option name="charting.seriesColors">[0xDF0101,0x088A08]</option>
0 Karma

jeremiahc4
Builder

Disregard, just read further on that link and found why. Now to figure out how to use that masterLegend property I guess.

0 Karma
Get Updates on the Splunk Community!

Changes to Splunk Instructor-Led Training Completion Criteria

We’re excited to share an update to our instructor-led training program that enhances the learning experience ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

❄️ Welcome the new year with our January lineup of Community Office Hours, Tech Talks, and Webinars! &#x1f389; ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...