This idea (bubble instead of a pie chart) fascinated me. I've a lot of moving mobile devices recording their ability to "phone home" as dispositions and need to know (with Splunk) when issues occur geographically. My evals post the geostats command are quite different and I'm by no means a Splunk expert, and I hope this, and the oxford comma are received well:
<dashboard>
<label>PMG Call Success map</label>
<row>
<panel>
<map>
<search>
<query>sourcetype=pmgCallRecs
earliest=-4h
| eval lat=latitude/10000000
| eval lon= longitude/10000000
| search lat > 10
| geostats count(eval(disposition=0)) as Successful, count(eval(disposition!=0)) as Failed
| eval Percent=round((Successful/(Successful + Failed)* 100),0)
| eval redCount = if(Percent <= 80,Successful + Failed,0)
| eval yellowCount = if((Percent > 80 AND Percent < 90),Successful + Failed,0)
| eval greenCount = if(Percent >=90,Successful + Failed,0)
| Fields - Successful - Failed - Percent</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="mapping.data.maxClusters">1500</option>
<option name="height">750</option>
<option name="mapping.drilldown">all</option>
<option name="mapping.map.center">(45.92,-92.5)</option>
<option name="mapping.map.zoom">4</option>
<option name="mapping.tileLayer.url">http://otile1.mqcdn.com/tiles/1.0.0/sat/{z}/{x}/{y}.jpg</option>
<option name="mapping.tileLayer.subdomains">[http://otile2.mqcdn.com/tiles/1.0.0/sat/{z}/{x}/{y}.jpg,http://otile3.mqcdn.com/tiles/1.0.0/sat/{z}/{x}/{y}.jpg,http://otile4.mqcdn.com/tiles/1.0.0/sat/{z}/{x}/{y}.jpg]</option>
<option name="mapping.markerLayer.markerMaxSize">50</option>
<option name="mapping.markerLayer.markerMinSize">5</option>
<option name="mapping.markerLayer.markerOpacity">0.8</option>
<option name="mapping.tileLayer.maxZoom">30</option>
<option name="mapping.tileLayer.minZoom">0</option>
<option name="mapping.fieldColors">{greenCount:0x00FF00,yellowCount:0xFFCC00,redCount:0xFF0000}</option>
</map>
</panel>
</row>
</dashboard>
... View more