I am trying to develop a visualization showing Splunk distributed architecture with dataflow using Flow Viz App. I want to be able to show architecture as per below diagram with tcp_eps as Events/s.
To achieve this, I am looking at example 2 shown in the documentation section of the app. You can also find that example image on Splunkbase of the app or if you have got the add-on on your local host, its link is most likely this But I am quite confused with the instructions. It says, "Each node should be delimited by three hypens "---"." But where or how do I setup a query that will show link in that path syntax format ?
Another thing I am unsure is where it states,
<existing query> | append [|inputlookup my_table_of_nodes.csv]
What exactly node data should the csv file contain ?
Can someone please help me with this ?
@chrisyounger
