• Todd Waller

Splunk: Adding custom colors to XML/HTML dashboard charts

Hello again everyone! Welcome back! This week we will show you how to add custom colors to your dashboard charts. I used to get the proper color codes but you can use whatever place you want to confirm the color codes. For this example I am using data that has a numerical value that I call "score", then I eval that score into "Severity" ranges I call "RR_Score" using the case statement, like this:

Once we have the scores in ranges I can then count the number of, in this example I will use "users", over what I call LOB by the score ranges. Like this

Then we can created a stacked bar chart that looks like this and save it as a dashboard panel so we can edit the source code:

Now go to the dashboard and edit the bar chart, we can add the charting.fieldColors option to the XML Source code for the dashboard panel, like this:

Now save the code change and you should get this:

If you are doing the dashboard in HTML, which is really the way you should do dashboards. (TIP: you can create the dashboard as XML and convert it using the "Convert to HTML option) You can add the code to the "VIEWS: VISUALIZATION ELEMENTS" portion of the HTML code. Like this:

And the HTML after the change

As you can see changing the color of the chart elements isn't difficult but know HOW to do it just takes a bit of practice. Hopefully this tip was helpful to you or what you are trying to accomplish. Have a great week!!

413 views0 comments

Recent Posts

See All

Do you need to dedup when using stats?

I had to do some casual counting of sourcetypes today. In the process I was trying to decide if I needed to dedup before going to stats. It seemed to me a dedup would, in theory, pass less data to sta

How do I learn Splunk administration?

Had an old coworker hit me up a week ago. He took a job as a SOC analyst where part of his job is going to be supporting Splunk. He's a smart guy but Splunk is more complex than it looks. Given I've a