1

I have this graph:

enter image description here

How can I change the color for every column from x-axis? For example, green for Low, yellow for Medium, orange for High and red for Critical

A part from query:

| eval status=case(duration>=0 AND duration<0.2, "Low", duration>=0.2 AND duration<0.5, "Medium", duration>=0.5 AND duration<0.7, "High", duration>=0.7, "Critical")

| chart count as "Requests" by status

| eval customSort=case(status="Low", 1, status="Medium", 2, status="High", 3, status="Critical", 4)

| sort customSort

| fields - customSort

Rain03
  • 41
  • 1
  • 7
  • 1
    unrelated to your question - but your search will likely run faster if you set your "status" field to the numeric values used for "customSort", and then change it from a number to text after it's sorted – warren Feb 28 '23 at 13:04

1 Answers1

2

This looks like a Classic Dashboard. If you want each status to have a different colour, then each status must represent a different series in your data.

Your Current Results:
status Requests
Low 10
Medium 20
High 30
Critical 40
Must be converted to:
Low Medium High Critical
10 20 30 40

To achieve this please append this SPL to your search:

| transpose column_name=status header_field=status

You can then go into your XML Source and add the following tag to your chart (feel free to change this slapdash colour-scheme).

<option name="charting.fieldColors">{"Critical":#FF0000,"High":#FF7600,"Medium":#FFE500,"Low":#007840}</option>
Tom
  • 635
  • 7