All Apps and Add-ons

user flow design on Sankey visualization in Splunk

saicool
Engager

Hello Splunkers,

I would like to show the user flow on Sankey visualization.For ,that i have index, source type ,interaction_id ,activity_id, screen_id flow_name ,component fields. In the component field, I have 2 values, one is APIGATEWAY and another one is ES. APIGATEWAY has some flow names and ES also has some flow names., there is a relation between those two flow name values.I need to get the relation between those flow names of APIGATEWAY to ES as two separate nodes or fields on Sankey visualization .* (Note: flow name (or) API name in APIGATEWAY that calls the another one or more flow name/API name
I have this query:
index=abc sourcetype=123 screen_id =xyz interaction_id=def |stats count by activity_id screen_id component flow_name|search flow_name!=""

Note: activity_id is different for all flow_names

alt text
Please suggest how to show the relation between APIGATEWAY and ES flow names on Sankey visualization

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...