Splunk Search

How to change color or style of a single line in line graph

feickertmd
Communicator

I have a timechart graph in which I have put an overlay to represent the max allowed value of used HDD space. Can I change this ONE LINE to be dashed, or at least a single bolder color than the rest?

1 Solution

cmerriman
Super Champion

i'm not sure you can change it to be dashed, but you should be able to change the color using the charting.fieldColors option. You should be able to use the field name and then it uses a hexadecimal color value. It might be the charting.seriesColors option, though, too.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartConfigurationReference

View solution in original post

0 Karma

niketn
Legend

Try the following:

<option name="charting.lineDashStyle">dashDot </option>

Following are various option for series style:
(dashDot | dot | longDash | longDashDot | longDashDotDot | shortDash | shortDot | shortDashDot | solid)

Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

feickertmd
Communicator

That changes all lines, unfortunately

0 Karma

niketn
Legend

Yes since it affects all Line series, I usually try creating chart as Column. So, only overlaid field is line and remaining are column. I do use fieldColors and seriesColor for all the series to have differnt prominence.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jackreeves
Explorer

Anyone know how to edit just one line rather than all lines using charting.lineDashStyle?

0 Karma

Graham_Hanningt
Builder

Yes. Use the charting.fieldDashStyles option. Tested in Splunk 7.3.0:

<option name="charting.fieldDashStyles">{"fieldname": "dash"}</option>

Graham_Hanningt
Builder

I wish there were a corresponding fieldLineWidths.

0 Karma

cmerriman
Super Champion

i'm not sure you can change it to be dashed, but you should be able to change the color using the charting.fieldColors option. You should be able to use the field name and then it uses a hexadecimal color value. It might be the charting.seriesColors option, though, too.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartConfigurationReference

0 Karma

feickertmd
Communicator

How did I miss that?1 I was too focused on seriesColors.

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...