Hi,
I'm new to vega and trying to show the group count of sourceaddress when you hover over the graph item. The sourceaddress is a string. I've tried various ways but the below only shows zero.
Any help would be much appreciated
Martin
{
"$schema": "https://vega.github.io/schema/vega-lite/v2.4.json",
data: {
url: {
%context%: true
%timefield%: @timestamp
index: "acsc-main-controls-*"
body: {
size: 1000
_source: ["@timestamp", "sourceaddress", "control", "controlcategory", "eventid", "acsctype"]
}
}
format: {property: "hits.hits"}
}
"width": 600,
"height": 400,
"transform": [
{
"summarize": [
{
"aggregate": "count",
"as": "xcount"
}
],
"groupby": ["_source.sourceaddress"]
},
{
calculate: "toDate(datum._source['@timestamp'])" as: "time"
}
],
"mark": {
"type": "circle",
"opacity": 0.8,
"stroke": "black",
"strokeWidth": 0
},
"encoding": {
"x": {
"field": "time",
"type": "temporal",
"axis": {"labelAngle": 0}
},
"y": {"field": "_source.control", "type": "nominal", "axis": {"title": ""}},
"tooltip": [
{"title": "Control Category", "type": "nominal", "field": "_source.controlcategory"},
{"title": "Control", "type": "nominal", "field": "_source.control"},
{"title": "Source Address", "type": "nominal", "field": "_source.sourceaddress"}, {"title": "Count", "type": "quantitative", "field": "xcount"}
],
"size": {
"field": "_source.sourceaddress",
"type": "nominal",
"legend": {"title": "Source Address", "clipHeight": 30},
"scale": {"range": [0, 1000]}
},
"color": {"field": "_source.control", "type": "nominal", "legend": null
}
}
"selection": {
"selector015": {
"type": "interval",
"bind": "scales",
"encodings": ["x", "y"],
"on": "[mousedown, window:mouseup] > window:mousemove!",
"translate": "[mousedown, window:mouseup] > window:mousemove!",
"zoom": "wheel!",
"mark": {"fill": "#333", "fillOpacity": 0.125, "stroke": "white"},
"resolve": "global"
}
},
}