Splunk Search

Splunk Visualization displaying the same color for both columns

TallBear
Engager

I am using the following query to display a result on a dashboard (query with sample data which resembles the data I use):

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status

 


And this is being returned by visualization:

TallBear_0-1740044787752.png

 

The issue I'm facing is both columns have the same color, but I want to each column to have its own unique color (this doesn't have to be predefined, it would be okay if Splunk itself chooses random colors). 

Thanks in advance!

 

Edit: typo

 

Labels (1)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @TallBear 

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status
``` Add the SPL below ```
| eval {Status}=amount
| fields - status amount

 

livehybrid_0-1740056594496.png

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

 

View solution in original post

livehybrid
SplunkTrust
SplunkTrust

Hi @TallBear 

The easiest way to achieve this is to create multiple series like this, and then change to stacked bar chart:

 

| makeresults
| eval zip="Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development"
| makemv delim=";" zip
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| stats values(ticket) as tickets by Status
| stats count(tickets) as amount by Status
``` Add the SPL below ```
| eval {Status}=amount
| fields - status amount

 

livehybrid_0-1740056594496.png

Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped.
Regards

Will

 

kiran_panchavat
SplunkTrust
SplunkTrust

@TallBear 

For the Bar Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#00FF00,"date_hour":#FFF700,"count":#00009C}</option>

Here status , date_hour and count are the fields names of the bar chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color  . You can put any hexadecimal color codes as per your wish.

After adding the options in the source code click on Save to save the changes.

NOTE: change your field name in the code. 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@TallBear 

Green:-

kiran_panchavat_2-1740047518693.png

You can use hexadecimal color to change it. 

kiran_panchavat_3-1740047550904.png

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@TallBear 

If you want to change the color, please use this. 

kiran_panchavat_0-1740047317649.png

In the source code you have to add an option inside the chart tag.

kiran_panchavat_1-1740047359139.png

For the Column Chart panel we have written the option as :

<option name="charting.fieldColors">

{"status":#66FF00,"date_hour":#FF0000,"amount":#00009C}</option>

Here status , and amount are the fields names of the column chart. Also you have to specify the hexadecimal codes of the colors for every fields which you want color  . You can put any hexadecimal color codes as per your wish.

 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 Charts are coloured by series i.e. each series has a different colour (until you have lots of series and the colours recycle). In your case, you only have one series, Status, which has two values. To get different colours, you need different series.

| makeresults
| eval zip=split("Test-10264,Production;Test-10262,Production;Test-102123,Production;MGM-1,Development;MGM-2,Development;MGM-3,Development;MGM-4,Development",";")
| mvexpand zip
| table zip _time
```End of sample data```
| rex field=zip "(?<ticket>.+?),(?<Status>.+$)"
| chart count(ticket) as tickets by _time Status
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...