Dashboards & Visualizations

Dashboard with Stacked Chart Custom Field Colors

acehlis
Engager

I've created a dashboard with four separate stacked charts. Each stacked chart has four fields: FAILURE, WARNING, OTHER, SUCCESS. I've modified the XML of the dashboard using:

<option name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xFF00FF,"SUCCESS":0x00FF00}</option>

But these modifications don't make it into my dashboard charts. Am I missing something or doing something wrong? I've tried several different ways of doing this and nothing seems to change the colors of the fields. Thanks.

0 Karma

acehlis
Engager

Yeah, I was afraid of that. I had seen that post, but it looked like the fix was a global tweek. I was able to get it presented with the FlashChart module, however I'm not sure that will be the best option in the long run. We have iPads being deployed to leadership, more and more.

I'd also like to note that it wasn't easy to find all the modules required to make the FlashChart look like the JSChart. It would be a nice documentation feature to break out examples in both JSChart and FlashChart.

Here's my FlashChart example, in case anyone else is looking to do the same thing, but hopefully JSChart gets the functionality soon:


<?xml version='1.0' encoding='utf-8'?>
<view template="dashboard.html">
<label>FlashChart Module Dashboard Example</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1"
group="Work Week (7AM Monday through 5PM Friday)" autoRun="True">
<param name="search">
search source=foo sourcetype=bar eventtype=workweek_hours | timechart span=1w count(TYPE) by TYPE usenull=f fixedrange=f
</param>
<param name="earliest">-365d@d</param>
<param name="latest">@d</param>
<module name="ResultsHeader">
<param name="entityName">scanned</param>
<param name="entityLabel">Events</param>
<module name="HiddenChartFormatter">
<param name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xBE00FF,"ACTIVE_OR_SUCCESS":0x00FF00}</param>
<param name="charting.chart.stackMode">stacked</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.data">results</param>
<module name="FlashChart">
<param name="height">400px</param>
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</view>

tysonstewart
Path Finder

When charts switched from default Flash to JSChart, I think they lost the fieldColors ability.
Related question and documentation. If you're OK with your chart using Flash, just specify the FlashChart module for that chart.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...