topic Re: D3 Visualization in Dashboards & Visualizations

D3 Visualization

rajgowd1 — Tue, 29 Sep 2020 11:21:13 GMT

Hi Experts,
can anyone please provide help on D3 integration in splunk for visualization.
i have below search and i want it to be visualized using D3.

sample output is

tcp 0 0 10.40.88.178:7171 poc-card-luna1.nad.ns:50326 ESTABLISHED
tcp 0 0 12b8-splfwd02.ndm.nsro:7171 poc-card-luna1.nad.ns:50326 TIME_WAIT
tcp 0 0 10.40.88.178:7171 poc-card-luna2.nad.ns:50326 TIME_WAIT

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
|chart values(state) by hostOrIp1 hostOrIp2

Re: D3 Visualization

msivill_splunk — Tue, 11 Oct 2016 15:03:27 GMT

https://docs.splunk.com/Documentation/Splunk/6.5.0/AdvancedDev/CustomVizTutorial covers how to build a custom visualization in Splunk. The example in the link also happens to use D3 as the visualization library.

Also worth looking at Splunkbase as a few custom visualizations ( https://splunkbase.splunk.com/apps/#/app_content/visualizations ) are already up there and some of which also use D3. It might be your D3 visualization you want to use has already be done and you can use that. Or you could install them and see how they work as a point of reference.

Re: D3 Visualization

rajgowd1 — Tue, 29 Sep 2020 11:21:40 GMT

HI,
is it possible to tune this query and show them in existing splunk visualization formats like bar,pie,line or area

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
| eventstats count by state hostOrIp1 hostOrIp2 |eval CountConnStatus=count+" - "+state|chart values(CountConnStatus) by hostOrIp1 hostOrIp2

Re: D3 Visualization

msivill_splunk — Tue, 11 Oct 2016 20:35:12 GMT

So this feels a bit like a follow up question. Would you mind accepting the answer for the D3 question (if it answers the D3 question). Then re-asking the follow up question as a new question. It should help other people who come to visit these questions at a later date. (Also a bit more detail on the follow question would be good).

So short answer, what you are asking for feels doable.