Dashboards & Visualizations

Why are the colors in my bar chart not changing as desired?

rkaakaty
Path Finder

So I am trying to change the colors of each bar value. I am not sure why it isnt' working.

Here is my code:

<dashboard>
  <label>Type_Panel</label>
  <row>
    <panel>
      <chart>
        <search>
          <query>eventtype=qualys_vm_detection_event STATUS!="FIXED"
| fillnull value=- PROTOCOL
| table TYPE, QID
| stats count by TYPE</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.fieldColors">
         {"CONFIRMED": 0xFF0000, "Potential": 0xF87217}
       </option>
      </chart>
    </panel>
  </row>
</dashboard>

Here is the picture of my current bar graph when I save that code:

alt text

0 Karma

cmerriman
Super Champion

Instead of the fieldColors option, try using the seriesColors option.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The fieldColors expect that "CONFIRMED" and "Potential" are column/field names not values. Your stats command has column/field name as TYPE. Try this search

eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID | eval temp=1
 | chart count by temp TYPE | fields - temp

OR

 eventtype=qualys_vm_detection_event STATUS!="FIXED"
 | fillnull value=- PROTOCOL
 | table TYPE, QID
 | stats count(eval(TYPE="CONFIRMED")) as CONFIRMED count(eval(TYPE="Potential")) as Potential

rkaakaty
Path Finder

these options did not work for me

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...