Dashboards & Visualizations

D3 Visualization

rajgowd1
Communicator

Hi Experts,
can anyone please provide help on D3 integration in splunk for visualization.
i have below search and i want it to be visualized using D3.

sample output is

tcp 0 0 10.40.88.178:7171 poc-card-luna1.nad.ns:50326 ESTABLISHED
tcp 0 0 12b8-splfwd02.ndm.nsro:7171 poc-card-luna1.nad.ns:50326 TIME_WAIT
tcp 0 0 10.40.88.178:7171 poc-card-luna2.nad.ns:50326 TIME_WAIT

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
|chart values(state) by hostOrIp1 hostOrIp2

Tags (1)
0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/6.5.0/AdvancedDev/CustomVizTutorial covers how to build a custom visualization in Splunk. The example in the link also happens to use D3 as the visualization library.

Also worth looking at Splunkbase as a few custom visualizations ( https://splunkbase.splunk.com/apps/#/app_content/visualizations ) are already up there and some of which also use D3. It might be your D3 visualization you want to use has already be done and you can use that. Or you could install them and see how they work as a point of reference.

rajgowd1
Communicator

HI,
is it possible to tune this query and show them in existing splunk visualization formats like bar,pie,line or area

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
| eventstats count by state hostOrIp1 hostOrIp2 |eval CountConnStatus=count+" - "+state|chart values(CountConnStatus) by hostOrIp1 hostOrIp2

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

So this feels a bit like a follow up question. Would you mind accepting the answer for the D3 question (if it answers the D3 question). Then re-asking the follow up question as a new question. It should help other people who come to visit these questions at a later date. (Also a bit more detail on the follow question would be good).

So short answer, what you are asking for feels doable.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...