All Apps and Add-ons

Flow_map Link-Labels change Name(of warn/error/good) or have extra options to specify and build different particle based on custom labelID


I wanted to work in a radius fashion where theres start/stop or have the ablity to change Warn to a custom one .(would be cool to have different colors based on different data points.)

good/warn/error i see 3 but my thought is to be able to change the name

so good would show start warn would show stop etc etc.

thanks this app really shows the beauty of viz potential 🙂

Tags (1)
0 Karma


haha whoops just about answering my own question

Oh i actually just found that theres a field called label in your example 2 in the documentation where you can change the label of the link text. x request/min with html tags too lol =).

i could probably have fun with this on a map of some sort too

0 Karma


Yep that's right. If you want to get real crazy you can embed a base64 image into your simple xml dashboard (or manually upload an image to the appserver/static directory of your app) and then use that on a node. The possibilities are really unlimited. If you like the app, please leave a vote on Splunkbase 🙂

Thanks for using my app

0 Karma


Ya it brings some awesome creativity. wish some Gtables had this expose out to query like this and open it up.

i did have a question say when i push path to eval it like this

| eval path=from. "---" .prop. "---" .to

its cool that it builts a parent -to- and what i noticed each of them the counters are like so


good: 182
good: 32
good: 6

(it all adds to 230)

But i wanted to change the word good to start but if i do label the numbers are off due to 1-1 mapping but you auto math out if split by same node ID

start----(prop 3 results) each a separated line

so it uses the count good/warn to then layout the number data

my main question is you have some magic to build if split by each number which is awesome (due to the magic you have done with can i call a variable to . show the label because i have 58 paths by generating query. but with that aa---bb---ccc . bb i cant change the label (would be kind of narly to do a output lookup and custom label)

Or maybe a better thing could i change the word good or warn internally and i see . you have 3 good/warn/error if we could have like 5 or more so we can have options on different . datapoint/color

it original is aa-cc but i added a hop in the middle and its total is 230 count

0 Karma


If I understand correctly, Yes it is the downside of using path that it makes it harder to customise. In the latest version released last night it has an example of how to use a lookup table to build a custom and complicated structure which you can then |append [|inputlookup xxx.csv]

0 Karma


ya i was able to use that which is cool so my structure to apply building icon to 10 different propertys with the append and labely to set it lower

Start---PROP---Stop_prop good=230

..................................................---------- prop-F1 ----- Prop_stop
....Start ----good:230----- PROP ---------- prop-F2 ----- Prop_stop
..................................................----------- prop-F4 ----- Prop_stop

which they all connect to 1 Property

and count from Start --- Prop = good:230 aand it splits the math by matching parent start---middle---end
but . what is cool is that the links from PROP to prop-F1 (it divides the actual number between then)

what i was trying to do is $VAR$ catching that path path you had under hood and so its a dynamic rewrite of your logic with just changing good label not the number .

| eval lblstart="Starts: " .$good$

so it wouldn't match the cause i think there's many more
this def gives me ideas to change color based on threshold where count is low

im just scratching the surface on alot of different cool ideas.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...