there isn't any way to wildcard the colors. this is a workaround:
in your query, write out something like ...|eval category2=category+":"+count|eval sort=case(category="Critical",1,category="Warning",2,category="Normal",3)|sort sort|fields category2 count you might want to add something to dummy encode that all categories are there, in case there are no Critical values or something.
something like this:
index=.....|stats count by category|append [|makeresults|eval category="Critical,Warning,Normal"|makemv category delim=","|mvexpand category]|fillnull count value=0|eval category2=category+":"+count|dedup category|eval sort=case(category="Critical",1,category="Warning",2,category="Normal",3)|sort sort|fields category2 count |fields - _time
and then in the simpleXML, put this <option name="charting.seriesColors">[0xff0000,0xff6600,0xffff00]</option> it will use Red, Orange and Yellow, in the order, based on the order the categories were sorted.
... View more
