All Apps and Add-ons

Forced directed graph Source and Destination node opposite arrow direction

h52huang
Path Finder

indexblabla | stats count by SourceNode DestinationNode | sort -count | table SourceNode DestinationNode count

So table renders
SourceNode DestinationNode count

But in the graph, the arrow comes from DestinationNode to SourceNode. If I swap query to `indexblabla | stats count by DestinationNode SourceNode | sort -count then the direction comes to correct, but the table is showing DestinationNode and then SourceNode, which is not wanted.

<row>
    <panel>
      <title>Table title</title>
      <table>
        <title>Source data</title>
        <search id="querysearchid">
          <query>index=blabla | stats count by SourceNode DestinationNode | sort -count | table SourceNode DestinationNode count</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
      </table>
    </panel>
    <panel>
      <title>Logins to and from selected host graph by this user</title>
      <viz type="force_directed_viz.force_directed">
        <title>graph title</title>
        <search base="querysearchid">
          <query/>
        </search>
        <option name="drilldown">none</option>
        <option name="force_directed_viz.force_directed.AttractDistanceMax">200</option>
        <option name="force_directed_viz.force_directed.AttractDistanceMin">60</option>
        <option name="force_directed_viz.force_directed.AttractForceStrength">-300</option>
        <option name="force_directed_viz.force_directed.CollisionIterations">1</option>
        <option name="force_directed_viz.force_directed.CollisionRadius">20</option>
        <option name="force_directed_viz.force_directed.CollisionStrength">0.7</option>
        <option name="force_directed_viz.force_directed.ColorRange1">100</option>
        <option name="force_directed_viz.force_directed.ColorRange1Code">#65a637</option>
        <option name="force_directed_viz.force_directed.ColorRange2">500</option>
        <option name="force_directed_viz.force_directed.ColorRange2Code">#6db7c6</option>
        <option name="force_directed_viz.force_directed.ColorRange3">1000</option>
        <option name="force_directed_viz.force_directed.ColorRange3Code">#f7bc38</option>
        <option name="force_directed_viz.force_directed.ColorRange4">10000</option>
        <option name="force_directed_viz.force_directed.ColorRange4Code">#f58f39</option>
        <option name="force_directed_viz.force_directed.ColorRange5">1000000</option>
        <option name="force_directed_viz.force_directed.ColorRange5Code">#d93f3c</option>
        <option name="force_directed_viz.force_directed.ForceCollision">20</option>
        <option name="force_directed_viz.force_directed.LineColor">enabled</option>
        <option name="force_directed_viz.force_directed.LinkDistance">100</option>
        <option name="force_directed_viz.force_directed.LinkLength">1</option>
        <option name="force_directed_viz.force_directed.RepelDistanceMax">50</option>
        <option name="force_directed_viz.force_directed.RepelDistanceMin">10</option>
        <option name="force_directed_viz.force_directed.RepelForceStrength">-140</option>
        <option name="force_directed_viz.force_directed.StrokeWidth">1</option>
        <option name="force_directed_viz.force_directed.arrows">enabled</option>
        <option name="force_directed_viz.force_directed.circleSize">5</option>
        <option name="force_directed_viz.force_directed.panzoom">enabled</option>
        <option name="force_directed_viz.force_directed.theme">dark</option>
        <option name="height">350</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">small</option>
      </viz>
    </panel>
  </row>
0 Karma

niketn
Legend

@h52huang, Try reversing the sequence of fields i.e.

<yourCurrentSearch>
| table DestinationNode SourceNode count

I actually noticed an issue with arrows lying outside the connecting line, when Source Pointed to Destination and also in a different row the Destination pointed to Source.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

h52huang
Path Finder

@niketnilay
Thank you so much. I tried that but they dont like the mental twist.

I am thinking 1possible way to get around, could be:
creating another hidden panel to drill down the forced directed graph, while the displayed graph just shows as table Source Destination.

However, hidden requires a token. I don't know if I can create a invisible field with a token...

Thank you~

0 Karma

h52huang
Path Finder

@niketnilay

I did small patches. So, made the panel hidden which is the 'Destn, Source' order, and drills down the graph. Then added another panel with Source, Destn order to show the event table for now. 😄

0 Karma

niketn
Legend

@h52huang, sure seems like a good workaround. You can go ahead and accept the answer. Or else post your own comment as answer and accept the same.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

h52huang
Path Finder

Where is the control for arrow directions please? @niketnilay @dperre_splunk Thank you

0 Karma

h52huang
Path Finder

I noticed on version 1.0.3, the directions are good. I copied over the same xml code to 2.0.0, and arrows are opposite. Could you please share ideas on if there's any tricks I can do from my side to have a fast fix on it? Appreciate 😄
@dperre_splunk

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...