Dashboards & Visualizations

Color Bubble Chart bubbles based the "size" field?

woodcock
Esteemed Legend

I am working from an answer at https://answers.splunk.com/answers/785029/what-is-the-best-way-to-get-100ish-greeenyellowred.html:

| windbag 
| head 100
| eval lenSample=len(sample) 
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1) 
| eval x = position%10 + 1 
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical") 
| table health x y lang

This allows me to control the colors with charting.fieldColors HOWEVER splunk expects the 4th field to be a number so the hover is displaying lang: NaN for Not-a-Number. OK, so I will swap the 2 non-axis fields around by altering the last 2 lines to this:

| eval health = case(lenSample<20,"1",lenSample<30,"2",lenSample<40,"3",lenSample>=0,"4") 
| table lang x y health

So now the hover is perfect (except for the fact that my health is a number instead of a name but I can live with that), however I am unable to control the colors by setting them based on health, because they are (by default) tied to the lang.

Regardless of the legend/search (either way is fine), how do I color the bubbles based on the health value AND have a way to see the value of lang (which is not, and cannot be, a number), either by hover or by legend?

P.S. I do note this documentation pages mentions that charting.annotation.categoryColors can be used but it doesn't show how; perhaps that could be exploited somehow?
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Area.2C_Bubble.2...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...