All Apps and Add-ons

MultiStage Sankey Diagram Count Issue

richardphung
Communicator

I am using this as a reference:
https://answers.splunk.com/answers/470198/how-to-create-a-multistage-sankey-diagram-with-a-s.html

I am trying to build a sankey diagram to map requests from source to a status (in this case action = success or failure):

index=win* | stats count by src dest action
| appendpipe        [stats count by src dest         |  rename src as source, dest AS target]
| appendpipe         [stats count by dest action        |  rename dest as source, action AS target]

But the problem is that it gives me a count of the actions (which there are only 2 possible actions), and not an actual count

So the original search:

 index=win* | stats count by src dest action

gives me a table like:

src | dest | action | count
ip1 srv1 failure 218
ip1 srv1 success 300
ip1 srv2 failure 1579
ip1 srv2 success 216
ip2 srv1 failure 1418
ip2 srv1 success 141
ip2 srv2 failure 97
ip2 srv2 success 1031

(there would be 8 combinations)

But the appendpipe to create the sankey:

| appendpipe 
    [stats count by src dest 
    |  rename src as source, dest AS target]
| appendpipe 
    [stats count by  dest action
    |  rename dest as source, action AS target]
| search source=*
| fields source target count

gives me a table like:
source | target | count
ip1 srv1 2
ip1 srv2 2
ip2 srv1 2
ip2 srv2 1
srv1 action1 2
srv1 action2 2
srv2 action1 2
srv2 action 2 2

1 Solution

richardphung
Communicator

I found the answer on one of the comments:

| table src dest action

View solution in original post

0 Karma

aleksandrovk
Engager

Managed to solve this problem by adding

index=win* | stats count by src dest action | rename count as realCount
 | appendpipe [stats sum(realCount) as count by src dest     |  rename src as source, dest AS target]
 | appendpipe  [stats sum(realCount) as count by dest action |  rename dest as source, action AS target]
 | search source=*
 | fields source target count
0 Karma

richardphung
Communicator

I found the answer on one of the comments:

| table src dest action

0 Karma

aleksandrovk
Engager

This doesn't solve the issue

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...