Splunk Search

how to change color for column chart

abi2023
Path Finder

| timechart span=1mon count by status | addtotals row=t col=f labelfield=Total True False "Not available" fieldname="Total_Count" | eval percent=round(((True/Total_Count)*100),0)
| table Date Percentage

I chose visualization column chart but I get only default color. How can I customize the color base on the range.

0- 50% RED 50-70 AS YELLOW 70-100 AS Green. 

 

<option name="charting.fieldColors">{"<50":"#e600ac","Up to 60":"#ff0000","Up to 80":"#ffa31a","Up to 100":"#33cc33"}</option>

 

I try modifying but it did not work. 

Can anion help 
Thanks

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

fieldColors is defining different colours for fields, not the values of those fields. You could convert the existing numbers to named ranges, doing something like this

| rangemap field=percent Low=0-49 Medium=50-59 Threshold=60-79 High=80-100
| chart max(percent) over _time by range

and then your charting.fieldColors could be

<option name="charting.chart.stackMode">stacked</option>
<option name="charting.fieldColors">{"Low":"#e600ac","Medium":"#ff0000","Threshold":"#ffa31a","High":"#33cc33"}</option>

if you make it a stacked bar chart, then you will collapse the gaps as you only have one range per date. Call the ranges what you like

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

fieldColors is defining different colours for fields, not the values of those fields. You could convert the existing numbers to named ranges, doing something like this

| rangemap field=percent Low=0-49 Medium=50-59 Threshold=60-79 High=80-100
| chart max(percent) over _time by range

and then your charting.fieldColors could be

<option name="charting.chart.stackMode">stacked</option>
<option name="charting.fieldColors">{"Low":"#e600ac","Medium":"#ff0000","Threshold":"#ffa31a","High":"#33cc33"}</option>

if you make it a stacked bar chart, then you will collapse the gaps as you only have one range per date. Call the ranges what you like

bowesmana
SplunkTrust
SplunkTrust

and if you don't want the legend, turn that off too

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...