Splunk Search

Chart Series colors keep rearranging themselves.

ocallender
Explorer

I have a timechart area chart that shows three types of event over time ("Node up", "Node Down' and "Node Rebooted"). I want the "Node UP" series to show in green, "Node Down" in red and "Node Rebooted" in yellow. I was able to get what I wanted using: [0xFFEE33,0x00FF00,0xFF0000]

However, I find that from time to time, the colors become rearranged. "Node UP" might become yellow, "Node Down" green and "Node Rebooted" Red. Whenthis happens, I have to rearrange the colors in the charting.seriesColors until I get it right. However, after some time, the colors change again.

How can I explicitly set the colors for each series so that each type of event always has the same color?

1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

I think what you're looking for is here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization

search on the page for charting.legend.masterLegend
Color assignments (colors to series, series labeled by legend) are index based. (like an array, not a Spunk index) and they're controlled by the "Master Legend". If you have multiple charts, there will be Slave Legends as well.

There are nice clear examples of Simple XML and Advanced XML on the doc page.
This should help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

nmshaikh
Engager

I was able to use charting.fieldColors as below to hard code color based on fields/series.

    <option name="charting.fieldColors">{"average\: duration":0x6666ff,"cnt\: fail":0xff4d4d,"cnt\: success":0x80ff80}</option>
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

I think what you're looking for is here:
http://docs.splunk.com/Documentation/Splunk/5.0.2/Viz/Chartcustomization

search on the page for charting.legend.masterLegend
Color assignments (colors to series, series labeled by legend) are index based. (like an array, not a Spunk index) and they're controlled by the "Master Legend". If you have multiple charts, there will be Slave Legends as well.

There are nice clear examples of Simple XML and Advanced XML on the doc page.
This should help.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

DominikGM
Explorer

The current reference for charting.legend.masterLegend (and all other chart configuration) is: http://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!