The splunk docs have this for the bubble chart format: <stats_command> <y-axis_field> <x-axis_field> <bubble_size_field>
The UI displays this for the format of the bubble chart: | stats x_value_aggregation y_value_aggregation size_aggregation
Why are the x and y values flipped?
In my bubble chart for over 4 hours of data, it works where the x value is first. But if I change the time period to 15 minutes the x value is now the second data point. The first point is now not even the y axis. It is now displayed in the legend. The category I picked is no longer the legend.
If you open a support ticket, it will languish forever. But if you go the bottom of the documentation page and answer "No" to the "Was this document topic helpful" and give your correct email address and all of these details, the docs team will open an internal ticket and they WILL get you the answers that you need AND update the docs page AND get the code changed, if necessary. The docs team ROCKS!