Splunk Search

Color results of pie chart based on a token

andres
Loves-to-Learn Lots

Hi,

My search returns a pie chart that is a sum of a variable (memory_usage_GB) and ploted by another variable (user).

....

| stats sum(memory_usage_GB) by user

....

On the other side, I have an input in the same dashboard where you can select a specific user. The input is referenced with the token $userfilter$.

I want the pie chart to color the result corresponding to the selected user in the input with one color, and all the other results with another color.

So in the XML of the pie chart, I have tried the following:

<option name="charting.fieldColors">{"$userfilter$": 0x39ff14,"all":0xa9a9a9}</option>

It colors the desired user. However,  I don't know how can I refer to the rest of the results.

Maybe there is another way to do the coloring in the search string?

Thank you!

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...