All Apps and Add-ons

Sankey diagram for IPs and Users- How do I append the second level of the sankey?

ff170a
Explorer

I'm struggling to create a sankey diagram that take an initial username and connects that user to IP addresses that are associated with that username. Then, take that IP address and see what other usernames might be associated with that IP address.

My initial search gets a list of IP addresses that is associated with a username. This works well, then I do the stats on those results and it looks great with sankey,

 

 

 

| stats count by username IP | rename username AS user IP AS address

 

 

 

 

ff170a_0-1667410028714.png

 

The problem comes with I try to append the second level of the sankey. I'm not quite sure how to take the address on the far right and create that second level, looking for associated usernames. My intention is to only go 3 levels. I assume I have to search by 'address' in my dataset to see what username is associated?

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Typically you would use appendpipe for this

See this link

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-multistage-Sankey-diagram-with-a-singl...

Also this is an example that simulates a bunch of users and ip addresses and the appendpipe swaps around the stats and does the source/target reverse. Hopefully it will help get you there.

| makeresults
| eval user=split("abcdefghijklmnopqrstuvwxyz", "")
| mvexpand user
| eval n=mvrange(1,3,1)
| mvexpand n
| eval user=user."-".n
| eval n=mvrange(1,3,1)
| mvexpand n
| eval t=mvindex(split("aa,bb,cc,dd,ee", ","), random() % 5)
| eval ip="10.1.1.".(random() % 10 + 10)
| stats count by user ip
| rename ip as target user as source
| appendpipe [ stats count by target source
  | rename target as x
  | rename source as target, x as source
]

 

View solution in original post

0 Karma

ff170a
Explorer

This works well, thank you! Is there any way to spawn this off a single username and then branch from there?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not sure I understand what you are asking - do you mean just search for a single user? If so, add the user=X in the search.

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Typically you would use appendpipe for this

See this link

https://community.splunk.com/t5/Splunk-Search/How-to-create-a-multistage-Sankey-diagram-with-a-singl...

Also this is an example that simulates a bunch of users and ip addresses and the appendpipe swaps around the stats and does the source/target reverse. Hopefully it will help get you there.

| makeresults
| eval user=split("abcdefghijklmnopqrstuvwxyz", "")
| mvexpand user
| eval n=mvrange(1,3,1)
| mvexpand n
| eval user=user."-".n
| eval n=mvrange(1,3,1)
| mvexpand n
| eval t=mvindex(split("aa,bb,cc,dd,ee", ","), random() % 5)
| eval ip="10.1.1.".(random() % 10 + 10)
| stats count by user ip
| rename ip as target user as source
| appendpipe [ stats count by target source
  | rename target as x
  | rename source as target, x as source
]

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...