Sankey diagram for IPs and Users- How do I append the second level of the sankey?

[ff170a]

I'm struggling to create a sankey diagram that take an initial username and connects that user to IP addresses that are associated with that username. Then, take that IP address and see what other usernames might be associated with that IP address.

My initial search gets a list of IP addresses that is associated with a username. This works well, then I do the stats on those results and it looks great with sankey,

| stats count by username IP | rename username AS user IP AS address

The problem comes with I try to append the second level of the sankey. I'm not quite sure how to take the address on the far right and create that second level, looking for associated usernames. My intention is to only go 3 levels. I assume I have to search by 'address' in my dataset to see what username is associated?

[ff170a]

This works well, thank you! Is there any way to spawn this off a single username and then branch from there?

[bowesmana]

Not sure I understand what you are asking - do you mean just search for a single user? If so, add the user=X in the search.

[bowesmana · Accepted solution]

Typically you would use appendpipe for this

See this link

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-multistage-Sankey-diagram-with-a-singl...

Also this is an example that simulates a bunch of users and ip addresses and the appendpipe swaps around the stats and does the source/target reverse. Hopefully it will help get you there.

| makeresults
| eval user=split("abcdefghijklmnopqrstuvwxyz", "")
| mvexpand user
| eval n=mvrange(1,3,1)
| mvexpand n
| eval user=user."-".n
| eval n=mvrange(1,3,1)
| mvexpand n
| eval t=mvindex(split("aa,bb,cc,dd,ee", ","), random() % 5)
| eval ip="10.1.1.".(random() % 10 + 10)
| stats count by user ip
| rename ip as target user as source
| appendpipe [ stats count by target source
  | rename target as x
  | rename source as target, x as source
]