Dashboards & Visualizations

Color Bubble Chart bubbles based the "size" field?

Esteemed Legend

I am working from an answer at https://answers.splunk.com/answers/785029/what-is-the-best-way-to-get-100ish-greeenyellowred.html:

| windbag 
| head 100
| eval lenSample=len(sample) 
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1) 
| eval x = position%10 + 1 
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical") 
| table health x y lang

This allows me to control the colors with charting.fieldColors HOWEVER splunk expects the 4th field to be a number so the hover is displaying lang: NaN for Not-a-Number. OK, so I will swap the 2 non-axis fields around by altering the last 2 lines to this:

| eval health = case(lenSample<20,"1",lenSample<30,"2",lenSample<40,"3",lenSample>=0,"4") 
| table lang x y health

So now the hover is perfect (except for the fact that my health is a number instead of a name but I can live with that), however I am unable to control the colors by setting them based on health, because they are (by default) tied to the lang.

Regardless of the legend/search (either way is fine), how do I color the bubbles based on the health value AND have a way to see the value of lang (which is not, and cannot be, a number), either by hover or by legend?

P.S. I do note this documentation pages mentions that charting.annotation.categoryColors can be used but it doesn't show how; perhaps that could be exploited somehow?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!