Dashboards & Visualizations

Is there any way we can have different colors on Bar chart based on X-Axis values?

Macky_29
Explorer

Hi Experts , 

Is there any way we can have different colors on Bar chart based on X-Axis values , below is code to my bar chart, i want to have different color bars for different countries (X-Axis values).

<search base="base_search">
<query>|search Country=$Country$|stats dc(conversation-id) by Country</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.minimumNumber">1</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.abbreviation">auto</option>
<option name="charting.axisY2.enabled">1</option>
<option name="charting.axisY2.scale">log</option>
<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">count</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"CD";10": 0xFF0000, "IND": 0xFF9900, "ZA":0x008000}</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">Country</option>
</chart>

Macky_29_0-1675372139436.png

 

 

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@Macky_29 

That's not how fieldColors works, as you only have a single series in your data

|stats dc(conversation-id) by Country

which is your 'dc(conversation-id)'.

The fieldColors represents the columns in your data, not the rows, so you can transpose those so that the rows become columns and then you can use fieldColors.

Use this command to transpose

| transpose 0 header_field=Country column_name=Conversations

and then your fieldColors should work.

View solution in original post

0 Karma

Macky_29
Explorer

Hi Rich, 

thanks for reply , i have made corrections but Still not working :

<query>|search Country=$Country$|stats dc(conversation-id) by Country</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisY.abbreviation">auto</option>
<option name="charting.axisY.minimumNumber">1</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.abbreviation">auto</option>
<option name="charting.axisY2.enabled">1</option>
<option name="charting.axisY2.scale">log</option>
<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">count</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.drilldown">none</option>
<option name="charting.fieldColors">{"CD":0xf7bc38, "IND":0xeeeeee, "ZA":0x65a637}</option>
<option name="charting.legend.placement">right</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.size">large</option>
<option name="trellis.splitBy">Country</option>
</chart>
</panel>

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@Macky_29 

That's not how fieldColors works, as you only have a single series in your data

|stats dc(conversation-id) by Country

which is your 'dc(conversation-id)'.

The fieldColors represents the columns in your data, not the rows, so you can transpose those so that the rows become columns and then you can use fieldColors.

Use this command to transpose

| transpose 0 header_field=Country column_name=Conversations

and then your fieldColors should work.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You already have the right idea, just not formatted correctly.  The charting.fieldColors option has to be pairs of strings and hex color numbers.  In the example code, the first string doesn't have a matching color code.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...