Dashboards & Visualizations

Dashboard with Stacked Chart Custom Field Colors

acehlis
Engager

I've created a dashboard with four separate stacked charts. Each stacked chart has four fields: FAILURE, WARNING, OTHER, SUCCESS. I've modified the XML of the dashboard using:

<option name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xFF00FF,"SUCCESS":0x00FF00}</option>

But these modifications don't make it into my dashboard charts. Am I missing something or doing something wrong? I've tried several different ways of doing this and nothing seems to change the colors of the fields. Thanks.

0 Karma

acehlis
Engager

Yeah, I was afraid of that. I had seen that post, but it looked like the fix was a global tweek. I was able to get it presented with the FlashChart module, however I'm not sure that will be the best option in the long run. We have iPads being deployed to leadership, more and more.

I'd also like to note that it wasn't easy to find all the modules required to make the FlashChart look like the JSChart. It would be a nice documentation feature to break out examples in both JSChart and FlashChart.

Here's my FlashChart example, in case anyone else is looking to do the same thing, but hopefully JSChart gets the functionality soon:


<?xml version='1.0' encoding='utf-8'?>
<view template="dashboard.html">
<label>FlashChart Module Dashboard Example</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSearch" layoutPanel="panel_row1_col1"
group="Work Week (7AM Monday through 5PM Friday)" autoRun="True">
<param name="search">
search source=foo sourcetype=bar eventtype=workweek_hours | timechart span=1w count(TYPE) by TYPE usenull=f fixedrange=f
</param>
<param name="earliest">-365d@d</param>
<param name="latest">@d</param>
<module name="ResultsHeader">
<param name="entityName">scanned</param>
<param name="entityLabel">Events</param>
<module name="HiddenChartFormatter">
<param name="charting.fieldColors">{"WARNING":0xFFFF00, "FAILURE":0xFF0000, "OTHER":0xBE00FF,"ACTIVE_OR_SUCCESS":0x00FF00}</param>
<param name="charting.chart.stackMode">stacked</param>
<param name="charting.legend.placement">bottom</param>
<param name="charting.data">results</param>
<module name="FlashChart">
<param name="height">400px</param>
<param name="width">100%</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</view>

tysonstewart
Path Finder

When charts switched from default Flash to JSChart, I think they lost the fieldColors ability.
Related question and documentation. If you're OK with your chart using Flash, just specify the FlashChart module for that chart.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...