All Apps and Add-ons

MultiStage Sankey Diagram Count Issue

richardphung
Communicator

I am using this as a reference:
https://answers.splunk.com/answers/470198/how-to-create-a-multistage-sankey-diagram-with-a-s.html

I am trying to build a sankey diagram to map requests from source to a status (in this case action = success or failure):

index=win* | stats count by src dest action
| appendpipe        [stats count by src dest         |  rename src as source, dest AS target]
| appendpipe         [stats count by dest action        |  rename dest as source, action AS target]

But the problem is that it gives me a count of the actions (which there are only 2 possible actions), and not an actual count

So the original search:

 index=win* | stats count by src dest action

gives me a table like:

src | dest | action | count
ip1 srv1 failure 218
ip1 srv1 success 300
ip1 srv2 failure 1579
ip1 srv2 success 216
ip2 srv1 failure 1418
ip2 srv1 success 141
ip2 srv2 failure 97
ip2 srv2 success 1031

(there would be 8 combinations)

But the appendpipe to create the sankey:

| appendpipe 
    [stats count by src dest 
    |  rename src as source, dest AS target]
| appendpipe 
    [stats count by  dest action
    |  rename dest as source, action AS target]
| search source=*
| fields source target count

gives me a table like:
source | target | count
ip1 srv1 2
ip1 srv2 2
ip2 srv1 2
ip2 srv2 1
srv1 action1 2
srv1 action2 2
srv2 action1 2
srv2 action 2 2

1 Solution

richardphung
Communicator

I found the answer on one of the comments:

| table src dest action

View solution in original post

0 Karma

aleksandrovk
Engager

Managed to solve this problem by adding

index=win* | stats count by src dest action | rename count as realCount
 | appendpipe [stats sum(realCount) as count by src dest     |  rename src as source, dest AS target]
 | appendpipe  [stats sum(realCount) as count by dest action |  rename dest as source, action AS target]
 | search source=*
 | fields source target count
0 Karma

richardphung
Communicator

I found the answer on one of the comments:

| table src dest action

0 Karma

aleksandrovk
Engager

This doesn't solve the issue

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...