Is there a way to change color on the chart to be yellow, pink, green, orange and blue instead of default ones (blue, yellow, orange, purple, and green)?
So far, I am able to accomplish these tasks
1. put datewday as the column and displayed on the chart
2. put on the host on the x series.
3. display datewday by monday - friday instead of alphabetically friday - wednesday
sourcetype="psoftapp-appsrv" host="csappprd*" earliest=-8d date_hour>= 9 date_hour<= 17 NOT date_wday=sunday NOT date_wday=saturday | rex field=_raw "GetCertificate\]\(3\) Returning context. ID=(?[^,]*)" | search NOT (userID=PSAPPSRV OR userID=GUEST) | bucket _time span=1d | stats count by _time, host, date_wday | xyseries host date_wday count | fields host monday tuesday wednesday thursday friday
Look into charting.seriesColors option for your chart (cannot be edited from dashboard editor, has to be put directly into simple XML). Here is an example from "Dashboards and Visualizations" manual (I'm still using 6.3, so that's where I'm quoting from):
<chart> <searchName>My saved report</searchName> <option name="charting.seriesColors"> [0xFF0000,0xFFFF00,0x00FF00] </option> </chart>
I believe you can specify up to 30 colors, but do get the manual and check by yourself.
There is also a much more elaborate
charting.myColorPalette... option family, but I never tried it myself.
I don't know how to change via "Simple XML source code"
Could you please guide me on that?
Does it mean you can't add any syntax to the search box?
After you generate a dashboard (most probably a form), you can then edit the source directly. That's where you will have to find your chart and add the options.
I would guess that there is a setting somewhere under etc/system which could change the default, or maybe it's in one of the Splunk's Python files, but in general, no, you can't do that in the simple search box. There's no reason for it, too - search is a development tool, not an end product.