Dashboards & Visualizations

Color Bubble Chart bubbles based the "size" field?

woodcock
Esteemed Legend

I am working from an answer at https://answers.splunk.com/answers/785029/what-is-the-best-way-to-get-100ish-greeenyellowred.html:

| windbag 
| head 100
| eval lenSample=len(sample) 
| stats avg(lenSample) AS lenSample BY lang
| streamstats count AS position
| eval position = position - 1
| eval y = 0 - (trunc(position/10) + 1) 
| eval x = position%10 + 1 
| eval health = case(lenSample<20,"Okay",lenSample<30,"Caution",lenSample<40,"Concern",lenSample>=0,"Critical") 
| table health x y lang

This allows me to control the colors with charting.fieldColors HOWEVER splunk expects the 4th field to be a number so the hover is displaying lang: NaN for Not-a-Number. OK, so I will swap the 2 non-axis fields around by altering the last 2 lines to this:

| eval health = case(lenSample<20,"1",lenSample<30,"2",lenSample<40,"3",lenSample>=0,"4") 
| table lang x y health

So now the hover is perfect (except for the fact that my health is a number instead of a name but I can live with that), however I am unable to control the colors by setting them based on health, because they are (by default) tied to the lang.

Regardless of the legend/search (either way is fine), how do I color the bubbles based on the health value AND have a way to see the value of lang (which is not, and cannot be, a number), either by hover or by legend?

P.S. I do note this documentation pages mentions that charting.annotation.categoryColors can be used but it doesn't show how; perhaps that could be exploited somehow?
https://docs.splunk.com/Documentation/Splunk/latest/Viz/ChartConfigurationReference#Area.2C_Bubble.2...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...