topic Re: Sankey - Visualization type in Dashboards & Visualizations

Sankey - Visualization type

jaibalaraman — Fri, 09 Aug 2024 03:56:00 GMT

Hi Team

Is there any way to create Sankey style tile for a single value , below image explaing abt group value.

Where i would like to break into single like Account locked , Invalid Login in separate tile

jaibalaraman_0-1723175709660.png

Re: Sankey - Visualization type

tscroggins — Sun, 11 Aug 2024 17:08:09 GMT

Hi @jaibalaraman,

You can use multiple Sankey visualizations to display a single source-target-value combination, or you can create mock visualizations using boxes, text, and a single-value visualization.

In this Splunk 9.3 example, I've used three adjacent boxes, with the center box having 50% transparency. A markdown element is placed over the center box to provide the text, and a single-value element is placed to the right to provide a count.

tscroggins_1-1723395942998.png

In your case, however, 403120 appears to be an event identifier and not a count.

What are you trying to communicate with individual tiles that can't be represented by a Sankey diagram?

Re: Sankey - Visualization type

jaibalaraman — Sun, 11 Aug 2024 22:52:04 GMT

I would like to display the count of the error code.

Re: Sankey - Visualization type

jaibalaraman — Sun, 11 Aug 2024 22:52:48 GMT

Also could you please share some example dashboard which you have used

Re: Sankey - Visualization type

tscroggins — Sat, 17 Aug 2024 16:07:46 GMT

Hi @jaibalaraman,

Here's a static example that uses separate elements to display a Sankey-like bar:

{ "visualizations": { "viz_GGlMQrhz": { "type": "splunk.rectangle", "options": { "fillColor": "#5a4575", "strokeColor": "#5a4575" } }, "viz_sdLspBWZ": { "type": "splunk.rectangle", "options": { "fillColor": "#5a4575", "strokeColor": "#5a4575", "fillOpacity": 0.5, "strokeOpacity": 0.5 } }, "viz_G2e5COXh": { "type": "splunk.rectangle", "options": { "fillColor": "#0877a6", "strokeColor": "#0877a6" } }, "viz_izmTEXa4": { "type": "splunk.singlevalue", "options": { "backgroundColor": "transparent", "majorFontSize": 20 }, "dataSources": { "primary": "ds_zydmsUyG" } }, "viz_OBDGe1i4": { "type": "splunk.markdown", "options": { "markdown": "****Account Temporarily Locked Out (403120)****", "fontSize": "custom", "customFontSize": 20 } } }, "dataSources": { "ds_zydmsUyG": { "type": "ds.search", "options": { "query": "| stats count\n| eval count=123", "queryParameters": { "earliest": "0", "latest": "" } }, "name": "Search_1" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "latest": "$global_time.latest$", "earliest": "$global_time.earliest$" } } } } }, "inputs": { "input_global_trp": { "type": "input.timerange", "options": { "token": "global_time", "defaultValue": "-24h@h,now" }, "title": "Global Time Range" } }, "layout": { "type": "absolute", "options": { "width": 1440, "height": 960, "display": "auto" }, "structure": [ { "item": "viz_GGlMQrhz", "type": "block", "position": { "x": 0, "y": 0, "w": 20, "h": 70 } }, { "item": "viz_sdLspBWZ", "type": "block", "position": { "x": 20, "y": 0, "w": 510, "h": 70 } }, { "item": "viz_G2e5COXh", "type": "block", "position": { "x": 530, "y": 0, "w": 20, "h": 70 } }, { "item": "viz_izmTEXa4", "type": "block", "position": { "x": 430, "y": 0, "w": 100, "h": 70 } }, { "item": "viz_OBDGe1i4", "type": "block", "position": { "x": 30, "y": 20, "w": 400, "h": 30 } } ], "globalInputs": [ "input_global_trp" ] }, "description": "", "title": "Sankey-like" }