All Apps and Add-ons

Timeline- Custom Visualization: How do I apply colors using the resource_field bins?

rbernharnavy
Engager

When applying the timeline visualization against table _time job_name duration, and selecting categorical color mode in the format menu, it doesn't seem to be picking up the resource_field, instead it picks up duration which results in a huge legend of many colors.

From the docs I see usage is table _time <resource_field> [<color_field>] [<duration_field>] ,
so I'm confused what color_field is for or how to properly apply colors using the resource_field bins.

0 Karma
1 Solution

niketnilay
Legend

@rbernharnavy try to create duplicate field for color in your case

 <yourCurrentColor>
| eval job_name_category=job_name
| table _time job_name job_name_category duration
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

joesrepsolc
Communicator

Not liking the default colors it selected.

0 Karma

joesrepsolc
Communicator

But can I manually set the colors used for this visualization like in other Splunk charts? I would like the colors for Excellent to be green, Poor to be red, etc.

Example:
<option name="charting.fieldColors">{"Unacceptable": #DC4E41,"Poor": #F1813F,"Fair": #F8BE34,"Good": #B6C75A,"Excellent": #53A051}</option>

0 Karma

quatorz
Engager

You need to set "Use colors" to "Yes" in the Format tab. Then it will interpret your color_field

niketnilay
Legend

@rbernharnavy try to create duplicate field for color in your case

 <yourCurrentColor>
| eval job_name_category=job_name
| table _time job_name job_name_category duration
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

rbernharnavy
Engager

That did it, thanks!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!