I went for the solution:
Define an array of colors to be used by setting mapping.seriesColors in Simple XML, e.g. [0xFF0000,0xFFFF00,0x00FF00]
To make it work for my purpose, I had to use a case statement (https://answers.splunk.com/answers/666322/edit-legend-from-choropleth-map-chart.html) to first generate all the categories, then sort them from the lowest to the highest, so that it can match the color order in the mapping.seriesColors.
1: Less 100 would get 0x00FF00 (green)
2: 100 to 500 would get 0xFFFF00 (yellow)
3: Over 500" would get 0xFF0000 (red)
Here a simplified example (as I had to do that for 9 categories...)
| eval count=case(count<100, "1: Less 100", (count>=100 AND count<500), "2: 100 to 500", count>500, "3: Over 500")
| sort +count
| geom geo_countries featureIdField=country
But honestly it's a pain. The proper way should be to be able to use sequential color mode and then be able to customize the data ranges for the legend.
... View more