Splunk Search

Splunk Visualization displaying the same color for both columns

TallBear
Engager

I am using the following query to display a result on a dashboard (query with sample data which resembles the data I use):

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status

 


And this is being returned by visualization:

TallBear_0-1740044787752.png

 

The issue I'm facing is both columns have the same color, but I want to each column to have its own unique color (this doesn't have to be predefined, it would be okay if Splunk itself chooses random colors). 

Thanks in advance!

 

Edit: typo

 

Labels (1)
0 Karma
1 Solution

livehybrid
Super Champion

Hi @TallBear 

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status
``` Add the SPL below ```
| eval {Status}=amount
| fields - status amount

 

livehybrid_0-1740056594496.png

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

 

View solution in original post

livehybrid
Super Champion

Hi @TallBear 

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status
``` Add the SPL below ```
| eval {Status}=amount
| fields - status amount

 

livehybrid_0-1740056594496.png

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

 

kiran_panchavat
Influencer

@TallBear 

For the Bar Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#00FF00,"date_hour":#FFF700,"count":#00009C}</option>

Here status , date_hour and count are the fields names of the bar chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color  . You can put any hexadecimal color codes as per your wish.

After adding the options in the source code click on Save to save the changes.

NOTE: change your field name in the code. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
Influencer

@TallBear 

Green:-

kiran_panchavat_2-1740047518693.png

You can use hexadecimal color to change it. 

kiran_panchavat_3-1740047550904.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
Influencer

@TallBear 

If you want to change the color, please use this. 

kiran_panchavat_0-1740047317649.png

In the source code you have to add an option inside the chart tag.

kiran_panchavat_1-1740047359139.png

For the Column Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#66FF00,"date_hour":#FF0000,"amount":#00009C}</option>

Here status , and amount are the fields names of the column chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color  . You can put any hexadecimal color codes as per your wish.

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 Charts are coloured by series i.e. each series has a different colour (until you have lots of series and the colours recycle). In your case, you only have one series, Status, which has two values. To get different colours, you need different series.

| makeresults
| eval zip=split("Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development",";")
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| chart count(ticket) as tickets by _time Status
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...