Hello all,
I'm attempting to make a multi-level sankey visualization mapping src_ip to dest_ip and then dest_ip to dest_port. The high level is that I'm looking for a visualization to see who's connecting to what and on which port. Sankey is ideal because you can quickly see if multiple soruces are connecting to the same IP and port.
I can get the src_ip to dest_ip line, but the problem I'm having is branching from there to another level for the ports. Currently the port is just displayed when moused over. I'm feeding it with a four column table currently:
| stats count by src_ip, dest_ip, dest_port | table src_ip, dest_ip, count, dest_port
