Recently I’ve spent some time dealing with Splunk. Despite the fact that I have already done various Splunk searches before, for example in “Tracking software versions using Nessus and Splunk“, the correlation of different events in Splunk seems to be a very different task. And there not so many publicly available examples of this on the Internet. Dismiss Join GitHub today. GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together. Without charting.fieldColors, the visualization uses default field color mapping based on the order of values returned. Here, ERROR appears blue. To change the field color mapping, add the charting.fieldColors property to the dashboard's Simple XML source code. Simple XML for timelines. Custom visualizations use a namespaced syntax for Simple XML. Specific visualization properties are appended to the app and visualization context. Add a timeline to a dashboard panel. You can add a timeline to a dashboard panel using Simple XML. Use this syntax to specify the app and visualization context.
11 Jan 2018 Add any chart to your dashboard, go to Edit > Source and specify option
Basically to answer your question, you can manually assign whatever color you want depending on the field name in your search. To do that you need to add new option name parameters for "charting.fieldColors" on your XML Dashboard. Splunk charts the count field, using the first color in the color series (green) for all values of count. You provided a legend, so it will always appear. However, count wasn't in the legend, so Splunk added it. So that's why you got the result that you did. How to customize assigned colors with dynamic labels from a pie chart? 0 I don't have any problems to show the pie chart with assigned colors with the fixed labels by just adding the following line to the Simple XML: When you load a saved report in the chart panel, your saved report format is also loaded. However, chart formatting can be overridden inline using the chart options. Charts use named options to specify chart-specific properties. This reference contains sections on all configurable properties of charts. Parent elements
Basically to answer your question, you can manually assign whatever color you want depending on the field name in your search. To do that you need to add new option name parameters for "charting.fieldColors" on your XML Dashboard.
1 Nov 2018 For the Column Chart panel we have written the option as :