Splunk Search

Splunk Visualization displaying the same color for both columns

TallBear
Engager

I am using the following query to display a result on a dashboard (query with sample data which resembles the data I use):

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status

 


And this is being returned by visualization:

TallBear_0-1740044787752.png

 

The issue I'm facing is both columns have the same color, but I want to each column to have its own unique color (this doesn't have to be predefined, it would be okay if Splunk itself chooses random colors). 

Thanks in advance!

 

Edit: typo

 

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @TallBear 

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status
``` Add the SPL below ```
| eval {Status}=amount
| fields - status amount

 

livehybrid_0-1740056594496.png

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

 

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @TallBear 

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status
``` Add the SPL below ```
| eval {Status}=amount
| fields - status amount

 

livehybrid_0-1740056594496.png

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

 

kiran_panchavat
SplunkTrust
SplunkTrust

@TallBear 

For the Bar Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#00FF00,"date_hour":#FFF700,"count":#00009C}</option>

Here status , date_hour and count are the fields names of the bar chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color  . You can put any hexadecimal color codes as per your wish.

After adding the options in the source code click on Save to save the changes.

NOTE: change your field name in the code. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@TallBear 

Green:-

kiran_panchavat_2-1740047518693.png

You can use hexadecimal color to change it. 

kiran_panchavat_3-1740047550904.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@TallBear 

If you want to change the color, please use this. 

kiran_panchavat_0-1740047317649.png

In the source code you have to add an option inside the chart tag.

kiran_panchavat_1-1740047359139.png

For the Column Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#66FF00,"date_hour":#FF0000,"amount":#00009C}</option>

Here status , and amount are the fields names of the column chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color  . You can put any hexadecimal color codes as per your wish.

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 Charts are coloured by series i.e. each series has a different colour (until you have lots of series and the colours recycle). In your case, you only have one series, Status, which has two values. To get different colours, you need different series.

| makeresults
| eval zip=split("Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development",";")
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| chart count(ticket) as tickets by _time Status
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...