All Apps and Add-ons

Flow Chart in SideView Utis

Path Finder

Hello everyone.
Working on a dashboard which has a requirement to display data in a flow.

Say I got 3 services.. A,B,C. On one particular transaction, service A called service B and in turn Service B called service C. Now each of this services is creating corresponding logs.

Now is there any way to show a flow chart kind of thing where I will create a flow diagram/any visualization to tell this whole story in a more meaningful manner.

SplunkTrust
SplunkTrust

OK. I can give you a couple directions.

1) I suspect that talk of visualization is an order of magnitude too sexy compared to what's actually needed here. This sounds like a use case where you really just need search language to massage the information about a given transaction, into a form where each service is a row.

1b) If that eventual result set is too ungainly to fit into one giant Table, or if it needs a touch of HTML formatting to make it palatable, you can use the "Embedding" feature of the Table module to embed any module config inside certain tablecells. The Sideview utils docs have examples of how to do this and it's very powerful.

For example you could get a Table with N rows - one for each service, and each row has a cell with a little chart, and another cell with a header and some little fields printed out in plain text. All this can be interactive so those charts can all have drilldowns etc, and you can have other form elements in there, and you can do inline drilldowns. Granted, what people usually embed is just an HTML module. 😉

2) In general when you want to show a table or a chart or an HTML block about some entity X, but you don't know how many X's there will be on the page, but you dont want to doom the stuff to living inside a Table via "table embedding" (see above), then this is a case for the Sideview Multiplexer module. You can "multiplex" any module config.

2b) If I were allowed to go a little crazy on these requirements, and assuming you have some kind of 'transaction id' field, I'd make a list view that lists a table of the transactions, use the Sideview Table module to hide the transaction id as one of the fields. use that field on a drilldown to a 'transaction_detail' view. Use the Multiplexer module on that detail view to multiplex say a search and a chart and a bit of HTML, per service involved. The multiplexer stuff is very advanced Sideview Utils stuff. My main disclaimer is that it may not be your cup of tea. The XML isn't very long but the whole idea of "multiplexing" other modules will make your head hurt.

3) The first thing that came to mind is more a source of inspiration and that's a hidden view in the Splunk on Splunk app called "masaakidiagramprototype".

You wont find this view in the navigation menus but you can manually go to it by going to

http://YOUR_SPLUNK_HOST:8000/en-US/app/sos/masaaki_diagram_prototype

The implementation is desperately unsexy, but quite quick and simple to put together, for what it gives the end user. In other words it's within reach of mere mortals. I threw it together for the SoS team long ago as a quick example. Basically it embeds a huge gif of a flow chart, where some of the circles have had their backgrounds knocked out to be transparent. Then an HTML module uses CSS to position a couple big layers behind those knocked-out-areas. Then some search language and a ResultsValueSetter conspire to turn the current index queue sizes into colors from green to red. The net effect is that the big flow chart diagram gets colors painted into it, and the colors represent the size of the given indexing queue.

download SoS if you don't have it already and crack open etc/apps/sos/default/data/ui/masaakidiagramprototype.xml

Path Finder

thanks. I will try one of them.

0 Karma

SplunkTrust
SplunkTrust

It's entirely possible to manually install the Splunk Webframework onto Splunk 5, see http://dev.splunk.com/view/webframework-standalone/SP-CAAAEMA for info.

0 Karma

Path Finder

Thankx you very much martin.
But I am planing to do it in Splunk 5.0.7. So D# visualziation is out of scope I guess.

0 Karma

SplunkTrust
SplunkTrust

With out-of-the-box visualizations that's going to be tough... however, using D3 charts you might find some of the directed graphs useful. Install the Splunk Webframework Toolkit and for example take a look at http://yourhost:8000/dj/en-us/splunk_wftoolkit/forcedirected/ for some inspiration. That's not a flowchart, but it's a step in the right direction.

0 Karma

Path Finder

Thankx for your response.
It will be a dynamic one. In my previous example I mentioned about 3 services, but the no. of service isnt a fixed entity. I just want a view where I will plot a chart/table/diagram whatever which will tell user the overview of the whole transaction.

0 Karma

SplunkTrust
SplunkTrust

Would your flowchart be a static image or would it be computed dynamically? ... or a little of both?

0 Karma