| head 100
| eval lenSample=len(sample)
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1)
| eval x = position%10 + 1
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical")
| table health x y lang
This allows me to control the colors with charting.fieldColors HOWEVER splunk expects the 4th field to be a number so the hover is displaying lang: NaN for Not-a-Number. OK, so I will swap the 2 non-axis fields around by altering the last 2 lines to this:
| eval health = case(lenSample<20,"1",lenSample<30,"2",lenSample<40,"3",lenSample>=0,"4")
| table lang x y health
So now the hover is perfect (except for the fact that my health is a number instead of a name but I can live with that), however I am unable to control the colors by setting them based on health, because they are (by default) tied to the lang.
Regardless of the legend/search (either way is fine), how do I color the bubbles based on the health value AND have a way to see the value of lang (which is not, and cannot be, a number), either by hover or by legend?