Splunk Search

How to change color or style of a single line in line graph

feickertmd
Communicator

I have a timechart graph in which I have put an overlay to represent the max allowed value of used HDD space. Can I change this ONE LINE to be dashed, or at least a single bolder color than the rest?

0 Karma
1 Solution

cmerriman
Super Champion

i'm not sure you can change it to be dashed, but you should be able to change the color using the charting.fieldColors option. You should be able to use the field name and then it uses a hexadecimal color value. It might be the charting.seriesColors option, though, too.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartConfigurationReference

View solution in original post

0 Karma

niketnilay
Legend

Try the following:

<option name="charting.lineDashStyle">dashDot </option>

Following are various option for series style:
(dashDot | dot | longDash | longDashDot | longDashDotDot | shortDash | shortDot | shortDashDot | solid)

Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

feickertmd
Communicator

That changes all lines, unfortunately

0 Karma

niketnilay
Legend

Yes since it affects all Line series, I usually try creating chart as Column. So, only overlaid field is line and remaining are column. I do use fieldColors and seriesColor for all the series to have differnt prominence.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jackreeves
Explorer

Anyone know how to edit just one line rather than all lines using charting.lineDashStyle?

0 Karma

Graham_Hanningt
Builder

Yes. Use the charting.fieldDashStyles option. Tested in Splunk 7.3.0:

<option name="charting.fieldDashStyles">{"fieldname": "dash"}</option>

Graham_Hanningt
Builder

I wish there were a corresponding fieldLineWidths.

0 Karma

cmerriman
Super Champion

i'm not sure you can change it to be dashed, but you should be able to change the color using the charting.fieldColors option. You should be able to use the field name and then it uses a hexadecimal color value. It might be the charting.seriesColors option, though, too.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartConfigurationReference

0 Karma

feickertmd
Communicator

How did I miss that?1 I was too focused on seriesColors.

Thanks

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>