There are two possible solutions: 1) You can assign colours explicitly and case by case in the chart or table options, for example: <option name="charting.fieldColors">{"COMPLETE":#358856,"CANCELED":#ED8440,"FAILED":#B90E0A,"PENDING":#7EA77B }</option> for tables you could use <colorPalette type="map">{"ACCESSORIES":#6DB7C6,"ARCADE":#F7BC38,"STRATEGY":#AFEEEE}</colorPalette> 2) If you are admin, you could create your own ui-prefs.conf in $SPLUNK_HOME/etc/system/local with following content and restart Splunk [default]
display.visualizations.charting.seriesColors = [0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f, 0x11a88b, 0xea9600, 0x0e776d, 0xffb380, 0xaa3977, 0x91af27, 0x4453aa, 0x99712b, 0x553577, 0x97bc71, 0xd35c2d, 0x314d5b, 0x99962b, 0x844539, 0x00b290, 0xe2c188, 0xa34a41, 0x44416d, 0xe29847, 0x8c8910, 0x0b416d, 0x774772, 0x3d9988, 0xbdbd5e, 0x5f7396, 0x844539] This would change default colours back to the old defaults of 8.x - but it only applies to the newly created charts using default colour scheme. It would also affect all users on the Search Head and require restart, so please test it before and use with caution.
... View more
