Splunk Search

How to separate colors on my bar chart

michaelnorup
Communicator

Hey guys.

So i have a search which created a bar chart

 

 

| rex field=_raw "(.Net Version is)\s+(?<DotNetVersion>.+)"
| stats latest(DotNetVersion) as DotNetVersion by host
| fillnull value="-"
| eval status=case(match(DotNetVersion,"Not!"),"noncompliant",1=1,"Compliant")
| chart count by status

 

 

 

michaelnorup_0-1645167974195.png

 

I have tried most options in the xml but i cant get it to be green/red =/

michaelnorup_1-1645168008278.png

 

Any ideas? Thought the ".fieldColors" would do the trick, but i think maybe my field is called "count" instead of Compliant/noncompliant



Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You need a (dummy) x-axis dimension

| eval label="count"
| chart count by label status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try seriesColors

<option name="charting.seriesColors">[#53A051,#DC4E41]</option>
0 Karma

michaelnorup
Communicator

This works if i change it to a pie chart, but it changed both colors in the bar chart

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need a (dummy) x-axis dimension

| eval label="count"
| chart count by label status

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats count by status
0 Karma

michaelnorup
Communicator

Nope =/

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...