There are two possible solutions:  1) You can assign colours explicitly and case by case in the chart or table options, for example:   <option name="charting.fieldColors">{"COMPLETE":#358856,"CANCELED":#ED8440,"FAILED":#B90E0A,"PENDING":#7EA77B }</option>   for tables you could use    <colorPalette type="map">{"ACCESSORIES":#6DB7C6,"ARCADE":#F7BC38,"STRATEGY":#AFEEEE}</colorPalette>       2) If you are admin, you could create your own ui-prefs.conf in $SPLUNK_HOME/etc/system/local with following content and restart Splunk     [default] display.visualizations.charting.seriesColors = [0x1e93c6, 0xf2b827, 0xd6563c, 0x6a5c9e, 0x31a35f, 0xed8440, 0x3863a0, 0xa2cc3e, 0xcc5068, 0x73427f, 0x11a88b, 0xea9600, 0x0e776d, 0xffb380, 0xaa3977, 0x91af27, 0x4453aa, 0x99712b, 0x553577, 0x97bc71, 0xd35c2d, 0x314d5b, 0x99962b, 0x844539, 0x00b290, 0xe2c188, 0xa34a41, 0x44416d, 0xe29847, 0x8c8910, 0x0b416d, 0x774772, 0x3d9988, 0xbdbd5e, 0x5f7396, 0x844539]   This would change default colours back to the old defaults of 8.x - but  it only applies to the newly created charts using default colour scheme. It would also affect all users on the Search Head and require restart, so please test it before and use with caution.  ... View more

Hi Anuja, I don't have a tutorial, but there are some hints on the "details" page. You have to download datasets from https://github.com/nltk/nltk_data/tree/gh-pages/packages and put it on your server in the nltk_data/bin folder manually. Afterward I was able to use language_detect and sentiment_analysis. Here is the list from available actions (from the #details page): Supported actions are: sentence_tokenize tokenize_and_tag word_tokenize definitions synonyms antonyms lemma language_detect sentiment_analysis Here is an example I used to test it: |makeresults | eval _raw="Good for job listings and getting back in touch with old friends!" |nltk action="sentiment_analysis" ... View more