Is there a way to map field values with particular colors on a bar chart?

[evang_26]

Hi users,

I am trying to color my bar charts to help a user's eye to focus on a more meaningful way to search output. While doing some searches about that I only found that one can change the colors of a search amending js scripts which is not my speciality. Is there any other to do while extracting the fields?

Here is a sample code:

sourcetype=nessus severity_id!=0 earliest=-2mon@mon latest=now | timechart span=1mon dc(cve) by severity 

Since Nessus assigns vulnerabilities into a severity which can be "critical", "high", "medium" and "low", my chart eventually is drawn up by 4 color bars. How to color bars based on a field value?

Thanks,
Evang

[somesoni2 · Accepted solution]

If you're using simple xml, you can use "charting.fieldColors" property to define specific color based on field name (and with your query you would get fields like critical/high/medium/low).

http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/ChartConfigurationReference#General_chart_prop...

e.g.

<option name="charting.fieldColors">
          {"critial": 0xFF0000, "high": 0xFF9900, "medium":0x0066FF, "low":0xC4C4C0}
        </option>

[evang_26]

Hi somesoni2,

That worked perfectly!

Thanks a lot,

Evang