How can we change the color column chart?

[LauraBre]

Hello,

I created a column chart and I want to associate one color to one value that my search can return. My search can return the number of value "YES" and "NO" that my field can take. This is my search:

source=tcp:5544 STAT_VE=YES OR STAT_VE=NO | chart count by PURCH_DAY,STAT_VE

I wan the number of "NO" appears in blue on my chart and the number of "YES" in green. This my xml file :

Time
Number of Transactions
column
stacked


{"No":0x3399CC, "Yes":0x00F66}

I tried this to associate a color but it doesn't work.

<option name="charting.fieldColors">{"No":0x3399CC, "Yes":0x00F66}</option>

Thanks by advance to your answer.

Laura

[lguinn2]

You will have to "trick" Splunk into doing this. Splunk assigns colors to a data series, not a data value. So split your search results into multiple series and used "stacked" charts.

This answer has more detail: Change Bar Chart Color based on Data Value