Splunk Search

how to change color for column chart

abi2023
Path Finder

| timechart span=1mon count by status | addtotals row=t col=f labelfield=Total True False "Not available" fieldname="Total_Count" | eval percent=round(((True/Total_Count)*100),0)
| table Date Percentage

I chose visualization column chart but I get only default color. How can I customize the color base on the range.

0- 50% RED 50-70 AS YELLOW 70-100 AS Green. 

 

<option name="charting.fieldColors">{"<50":"#e600ac","Up to 60":"#ff0000","Up to 80":"#ffa31a","Up to 100":"#33cc33"}</option>

 

I try modifying but it did not work. 

Can anion help 
Thanks

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

fieldColors is defining different colours for fields, not the values of those fields. You could convert the existing numbers to named ranges, doing something like this

| rangemap field=percent Low=0-49 Medium=50-59 Threshold=60-79 High=80-100
| chart max(percent) over _time by range

and then your charting.fieldColors could be

<option name="charting.chart.stackMode">stacked</option>
<option name="charting.fieldColors">{"Low":"#e600ac","Medium":"#ff0000","Threshold":"#ffa31a","High":"#33cc33"}</option>

if you make it a stacked bar chart, then you will collapse the gaps as you only have one range per date. Call the ranges what you like

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

fieldColors is defining different colours for fields, not the values of those fields. You could convert the existing numbers to named ranges, doing something like this

| rangemap field=percent Low=0-49 Medium=50-59 Threshold=60-79 High=80-100
| chart max(percent) over _time by range

and then your charting.fieldColors could be

<option name="charting.chart.stackMode">stacked</option>
<option name="charting.fieldColors">{"Low":"#e600ac","Medium":"#ff0000","Threshold":"#ffa31a","High":"#33cc33"}</option>

if you make it a stacked bar chart, then you will collapse the gaps as you only have one range per date. Call the ranges what you like

bowesmana
SplunkTrust
SplunkTrust

and if you don't want the legend, turn that off too

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...