Color Bubble Chart bubbles based the "size" field?

woodcock — Mon, 25 Nov 2019 21:28:33 GMT

I am working from an answer at https://answers.splunk.com/answers/785029/what-is-the-best-way-to-get-100ish-greeenyellowred.html:

| windbag 
| head 100
| eval lenSample=len(sample) 
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1) 
| eval x = position%10 + 1 
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical") 
| table health x y lang

This allows me to control the colors with charting.fieldColors HOWEVER splunk expects the 4th field to be a number so the hover is displaying lang: NaN for Not-a-Number. OK, so I will swap the 2 non-axis fields around by altering the last 2 lines to this:

| eval health = case(lenSample<20,"1",lenSample<30,"2",lenSample<40,"3",lenSample>=0,"4") 
| table lang x y health

So now the hover is perfect (except for the fact that my health is a number instead of a name but I can live with that), however I am unable to control the colors by setting them based on health, because they are (by default) tied to the lang.

Regardless of the legend/search (either way is fine), how do I color the bubbles based on the health value AND have a way to see the value of lang (which is not, and cannot be, a number), either by hover or by legend?

P.S. I do note this documentation pages mentions that charting.annotation.categoryColors can be used but it doesn't show how; perhaps that could be exploited somehow?
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Area.2C_Bubble.2C_Bar.2C_Column.2C_Line.2C_and_Scatter_charts

topic Color Bubble Chart bubbles based the "size" field? in Dashboards & Visualizations

Color Bubble Chart bubbles based the "size" field?