I am working from an answer at https://answers.splunk.com/answers/785029/what-is-the-best-way-to-get-100ish-greeenyellowred.html:
| windbag
| head 100
| eval lenSample=len(sample)
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1)
| eval x = position%10 + 1
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical")
| table health x y lang
This allows me to control the colors with charting.fieldColors HOWEVER splunk expects the 4th field to be a number so the hover is displaying lang: NaN for Not-a-Number. OK, so I will swap the 2 non-axis fields around by altering the last 2 lines to this:
| eval health = case(lenSample<20,"1",lenSample<30,"2",lenSample<40,"3",lenSample>=0,"4")
| table lang x y health
So now the hover is perfect (except for the fact that my health is a number instead of a name but I can live with that), however I am unable to control the colors by setting them based on health, because they are (by default) tied to the lang.
Regardless of the legend/search (either way is fine), how do I color the bubbles based on the health value AND have a way to see the value of lang (which is not, and cannot be, a number), either by hover or by legend?
P.S. I do note this documentation pages mentions that charting.annotation.categoryColors can be used but it doesn't show how; perhaps that could be exploited somehow?
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Area.2C_Bubble.2...
