Dashboards & Visualizations

D3 Visualization

rajgowd1
Communicator

Hi Experts,
can anyone please provide help on D3 integration in splunk for visualization.
i have below search and i want it to be visualized using D3.

sample output is

tcp 0 0 10.40.88.178:7171 poc-card-luna1.nad.ns:50326 ESTABLISHED
tcp 0 0 12b8-splfwd02.ndm.nsro:7171 poc-card-luna1.nad.ns:50326 TIME_WAIT
tcp 0 0 10.40.88.178:7171 poc-card-luna2.nad.ns:50326 TIME_WAIT

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
|chart values(state) by hostOrIp1 hostOrIp2

Tags (1)
0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/6.5.0/AdvancedDev/CustomVizTutorial covers how to build a custom visualization in Splunk. The example in the link also happens to use D3 as the visualization library.

Also worth looking at Splunkbase as a few custom visualizations ( https://splunkbase.splunk.com/apps/#/app_content/visualizations ) are already up there and some of which also use D3. It might be your D3 visualization you want to use has already be done and you can use that. Or you could install them and see how they work as a point of reference.

rajgowd1
Communicator

HI,
is it possible to tune this query and show them in existing splunk visualization formats like bar,pie,line or area

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
| eventstats count by state hostOrIp1 hostOrIp2 |eval CountConnStatus=count+" - "+state|chart values(CountConnStatus) by hostOrIp1 hostOrIp2

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

So this feels a bit like a follow up question. Would you mind accepting the answer for the D3 question (if it answers the D3 question). Then re-asking the follow up question as a new question. It should help other people who come to visit these questions at a later date. (Also a bit more detail on the follow question would be good).

So short answer, what you are asking for feels doable.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...