I would like to know If I can define a particular color for each line

[leandrot]

Hi all,

On the graphic below, each line represents an office, I would like to know, if it is possible, to define, a color for each office, despite if the office appears or not in the timeframe selected.

Thanks in advance to all Splunkers!

[leandrot]

Thanks for the reply I have been able to achieve this by adding "over sourcetype" on the search

[somesoni2]

If the name of the offices (which I'm assuming appears as a field in your result) has a definite/static names, you can use charting.fieldColors attribute in your chart to specify color that you want to use for your office/field.
http://docs.splunk.com/Documentation/Splunk/6.6.2/Viz/BuildandeditdashboardswithSimplifiedXML#Specif...

[leandrot]

Thanks for the reply. But, how can I do it, if it is not as a field in a result ?
As an example I have a query " dedup AGENT | stats count(AGENT) as "User Count" by OFFICE | table OFFICE "User Count" " which returns as a bar chart, the amount of users in each office.

Thanks in advance

[somesoni2]

Then you'd use charting.seriesColors attribute (see this link and scroll down the table for that attribute). Only caveat is that Splunk will use those colors sequentially, so the order of color you define there should match with your OFFICE values (they should be sorted ascending order of OFFICE after stats.

[edmanicus]

Some gave you pretty good information on it and if that doesn't answer the question I got most of my ideas on this topic from this page here:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Chartcustomization#Chart_colors

Sometimes default colors make my charts tougher to read so I definitely understand the need.