Is there a method to sort sankey by the largest cumulative item in the left side group?
I'm doing some throughput analysis and I i'm displaying volume between two nodes and we need to see it arranged from biggest to smallest.
I've tried doing a cumulative total and sorting on that.
The stats table I produce is in the correct order but the sankey makes its own determination that I can't figure out.
I've sorted through every available field and can't figure out what it is using as a sort.
It should be possible to develop a custom command in Splunk which sorts Tree segments in the desired order and then pass the output to a Sankey diagram for visualisation.
This is my attempt to develop a custom sorting:
I just came across your question. We do not support sorting in the current version of the Sankey, but I have filed your feature request for consideration in the future. Let us know if you found a way to do it that was good enough for you. Someone else might be interested.
Thanks for the feedback!