Dashboards & Visualizations

How to create a Bar Chart with different categories and corresponding color

POR160893
Builder

Hi,

I have a bar chart where I need each bar to represent a different category (each with a different colour), similar to how each section og my pie charts represent a different section:

POR160893_0-1657009696393.png



Here is the XML for my current bar chart?

<chart>
<search>
<query>
| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')

| chart count over "Completion Status"
</query>
</search>
<option name="charting.chart">column</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">top</option>
<option name="charting.seriesColors">[0x008000,0xffff00,0xff0000]</option>
</chart>



Can you please help?


Thanks so much!

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Pie chart recognizes the sole groupby variable as series, therefore they are assigned different colors.

Column chart has two variables.  You can turn categories into series by using "by" instead of "over".  But to force "chart" command to recognize this, you also need a constant to chart over.  So, change the search to

| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')
| eval dummy = 0
| chart count over dummy by "Completion Status"

 Hope this helps.

View solution in original post

Tags (1)

yuanliu
SplunkTrust
SplunkTrust

Pie chart recognizes the sole groupby variable as series, therefore they are assigned different colors.

Column chart has two variables.  You can turn categories into series by using "by" instead of "over".  But to force "chart" command to recognize this, you also need a constant to chart over.  So, change the search to

| inputlookup Migration-Status-McAfee
| fillnull value=null
| eval "Completion Status"=if('Completion Status'=""," ",'Completion Status')
| eval dummy = 0
| chart count over dummy by "Completion Status"

 Hope this helps.

Tags (1)

gcusello
Legend

Hi @POR160893,

what's your requirement: to have the same colours in a Histogram and a Pie chart or what else?

If this is your requirement, you have to fix the colours for the values you can have.

You can do this by GUI or by code:

<option name="charting.fieldColors">{"informational":#0099E0,"low":#55C169,"medium":#CBA700,"high":#D41F1F,"critical":#3C444D}</option>

Ciao.

 Giuseppe

POR160893
Builder

The requirement is to have a bar chart where each bar represents the count for a particular category and on the legend, each category bar would be a different colour and the category name will be shown as opposed to count(category) ..... is that possible?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set completion status to something other than a space

| eval "Completion Status"=if('Completion Status'="","N/A",'Completion Status')
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...