How to customize bar chart colors based on the values?

[guimilare]

Hi Splunkers.

I've been trying for a while to customize a bar chart I have.
Here are the data I have:

range            count
<2000            4804
Up to 3000       201
Up to 4000        96
Up to 5000          49
Up to 6000        21
Up to 7000        21
>7000             141

On the graph, all bars are blue. I need the first value (<2000) to be Green, the value (>7000) to be Red and the other ones to be Yellow.

Do you guys have any idea how could I achieve this?

Thanks in advance.
Best Regards

[cblanton]

I think that fact that your field values indicate a numerical range is causing unnecessary confusion. Does this work?

<option name="charting.fieldColors">{"<2000":#A6CE39,">7000:#ED1C24,"Up to 3000":#FFDA00,"Up to 4000":#FFDA00,"Up to 5000":#FFDA00,"Up to 6000":#FFDA00,"Up to 7000":#FFDA00 }</option>

[aljohnson_splun]

I copied the title of your question into the search bar, to find:

1.) https://answers.splunk.com/answers/334434/how-to-display-certain-colors-in-a-graph-based-on.html
2.) https://answers.splunk.com/answers/200861/how-to-change-bar-colors-in-a-bar-chart-based-on-v.html
3.) https://answers.splunk.com/answers/145120/bar-chart-column-color-based-on-value.html
4.) https://answers.splunk.com/answers/7228/change-column-color-if-over-a-range.html

although I am sure there are many others...

---

Please look at this documentation.

---

Usually the tricky part is getting the ranges mapped to some values. Thankfully, this is pretty easy to do with a rangemap command.

| rangemap field=count green=0-1999 yellow=2000-7000 red=7000-15000

or with the case function:

| eval color_map = case(count>7000, "red", count>2000, "yellow", count>0, "green")

Then in your xml, you have to use the series colors in the dashboard XML referenced in the documentation above:

<option name="charting.fieldColors">
  {"red":0xFF0000,"yellow":0xFFFF00,"green":0x00FF00}
</option>

Of course replacing the hex values FFFF00 with the hues of your choice.

[samhodgson]

I have used the rangemap method above like this:

| rangemap field=Percent green=0-100 red=100-1500

This provides another field either red or green depending on the value however the chart colours are not affected. I have added the charting.fieldColors option in the XML but I cant get the colour on the bar to map to the field outputted by the rangemap command. This is driving me nuts, i've tried the eval method too to no avail. Any suggestions on where im might be going wrong here would be greatly appreciated.

[evinasco]

Hi, could you solve this doubt ?, I need to do the same range with bar graph

[guimilare]

Hi alijohnson.

Before posting my question I read several answers abaout this topic.
But all of them did not helped.

In the example you gave, the bar will be red, yellow or green based on the value of the filed "count".
However, what I really want is that the field value "<2000" (that will be on the X axis) have always the color Green, regardless the value of count.