Splunk Search

How do I customize the bar colors for my dashboard bar chart?

hqw
Path Finder

alt text

Hi all,

May i know if there is any way to change the colors of the bars in this screenshot? I want the grey part to display on the bottom, and the orange part should be on top. Can I do this by modifying the Simple XML?

Thanks in advance

1 Solution

rsennett_splunk
Splunk Employee
Splunk Employee

Yes, you can deliberately assign colors to series (in order) rather than letting Splunk make the assignements:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

View solution in original post

rsennett_splunk
Splunk Employee
Splunk Employee

Yes, you can deliberately assign colors to series (in order) rather than letting Splunk make the assignements:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

hqw
Path Finder

Hi there,

Actually my question is not about assign colour, colour doesn't matter. These two colour stand for different things A and B, my question is how to switch the location of A and B. Currently A is on the top, what i want is to display it on the bottom.

The issue has been fixed by rename A and B. I supposed it is due to the order of first letter of A and B.

Thanks for your support and kindness.

0 Karma

gcato
Contributor

Output order is important and can be controlled using the 'table' command to switch A and B.

rsennett_splunk
Splunk Employee
Splunk Employee

Yes, Agreed. We can leave this one, since the question asked about changing the colors. 🙂

hqw: It would be wonderful if you created another question asking about changing the appearance order of series. Show your search and the result here, and then answer it yourself, showing your solution and the new image... you might add the bit about color order too (the colors are in an indexed array, so the order matters, although you can name them specifically too. You'll get Karma points and people like @gcato can put there variations up there too!

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...