All Apps and Add-ons

Sankey Diagram - Custom Visualization: Is it possible to order the Sankey chart elements on the x-axis?

csiess
Explorer

Hi,

Is there any chance to order the Sankey chart elements on the x-axis? I have the problem that the Sankey chart shows the correct results, but the order is not how I want them.
As you can see in the attached screenshot, the order of the nodes is: 1, 3, 2, 4, 5; However I need to have them 1,2,3,4,5;.

Thanks for your suggestions,
Christoph

sankey

0 Karma
1 Solution

mporath_splunk
Splunk Employee
Splunk Employee

Unfortunately that's not possible in the current version. The layout is determined automatically.

It's hard to see in the screenshot what you are using the Sankey Chart for. Could you elaborate on your use case? This could make it into a future update.

View solution in original post

1I
Engager

Digging through some examples found online and in the Sankey docs I put together the following general solution to your problem, albeit on my data set. In order to make a multi stage Sankey diagram I used the following approach. Add additional fields as needed, following the pattern.:
1) Pick the fields you want to link
2) Perform a stats count on all the fields you want to use, in the order you want them in
3) Build appendpipe's for each pair of fields, in the order you want and rename them to source and target
4) Set up the 'source target count' final fields output selection
5) Select the Sankey diagram on the output

index=
| stats count by

| appendpipe [stats count by | rename as source, as target]
| appendpipe [stats count by | rename as source, as target]
| appendpipe [stats count by | rename as source, as target]
| search source=*
| fields source target count

0 Karma

jkat54
SplunkTrust
SplunkTrust

It sounds like the sankey would be fine if all tickets had a "in progress" time stamp. Is this true?

If so you could use an eval statement like this to create an in progress timestamp: (pseudo code not Splunk ready)

Eval inProgressTime=ifnull(inProgressTime,newTime+1s,inprogressTime)

Where newTime would be the timestamp of the ticket creation.

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

Unfortunately that's not possible in the current version. The layout is determined automatically.

It's hard to see in the screenshot what you are using the Sankey Chart for. Could you elaborate on your use case? This could make it into a future update.

csiess
Explorer

Hi Michael,

sure... What I try to visualize is a process and the different stages an object can pass through.
Imagine something like Trouble Tickets and States "New", "In Progress", "Solved".

What I'm doing is: Fetch Ticket informations via DB Input, Calculate last state and current state (via streamstats with windows=2) and then visualize this.

In this example the Nodes on the X-Axis would be labled "New", "In Progress", "Solved", .... I'm using the sankey diagram to visualize the transitions between the states. Because a ticket should transit from "New" to "In Progress" to "Solved", however once in a while a ticket directly transits from "New" to "Solved" - this is what I'm trying to visualize.

Got my point?

thanks,
Christoph

0 Karma

mporath_splunk
Splunk Employee
Splunk Employee

Yes, that makes sense. Thanks!

0 Karma

bmacias84
Champion

Have you tried using the sort command. ...| sort field1 field2

0 Karma

csiess
Explorer

Hi,

yep - tried this. Sorting the field does not change the order of the nodes in the sankey diagram.
I think this could be adressed by implementing something similar to http://stackoverflow.com/questions/21539265/d3-sankey-charts-manually-position-node-along-x-axis

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...