How do you create a dashboard with dependencies between assets, like a tree or topology?

[jfeitosa_real]

Basically, I want to know how you create a dashboard with dependencies between assets, like a tree or topology, something like the one used in the "IT Service Intelligence" app?

I want to do this in a production environment, where there are multiple assets from different contexts that send logs to Splunk (Mainframe, Windows event viewer, Linux, Apache web servers, application servers, switches, routers or firewalls). These Configuration Items (ICs) are dependent on each other, and when an incident occurs in one of these assets, they would be in a dependency tree format, something like a topology, as in the link example.

http://docs.splunk.com/Documentation/VMW/3.4.2/User/ProactiveMonitoring

Thank you very much in advance.

[niketn · Accepted solution]

@jfeitosa_real following are some of your options:

1) Custom Visualizations (Legacy) has Dendrogram visualization similar to the one shown in ITSI. Since this is a legacy visualization not built on top of Splunk Custom Visualizations API, you should ideally build your own by adoptind Dedrogram logic as per your needs.
2) Network Topology Custom Visualization built by Splunk Works, refer to one of my older answers as to how you can show systems and their dependencies using this Custom Visualization: https://answers.splunk.com/answers/681147/topology-visualization-message-format.html
3) Force Directed App for Splunk built by Splunk Works, which is similar to above custom visualization but provides a simple Force Directed Graph visualization.
3) Afterglow App which can be downloaded for free but is hosted externally.
4) Sankey Diagram Custom Visualizationbuilt by Splunk.
5) Parallel Coordinates Custom Visualization built by Splunk which would be useful if you have data from system passing through 1 or 2 hops.

If you do not find any of the above suitable as per your needs you can definitely build your own Custom Visualization using Splunk Custom Visualization API with the link provided above.

[jfeitosa_real]

Hi, niketnilay!

Thank you for the informations. I found the Network Topology app cool, but I need something like a topology in PRTG or Nagios, interactively clicking on an asset that has been affected by some incident, graphically displaying other assets that are in the same dependency ...
I think you can use some of the options that you have, but you will need to develop using jquery or another language.

Thanks.

[niketn]

@jfeitosa_real Custom Visualization Legacy has Dendrogram, give that a try as well. If it does not work you can definitely choose Splunk Custom Visualization API. The documentation also provides a step by step instructions to create a visualization where you can use JavaScript based Visualization libraries like D3, Canvas, SVG, HighCharts etc to build Dendrogram yourself!

[mstjohn_splunk]

@jfeitosa_real,

Thanks for posting. Could you give us some more context for your question? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.

[jfeitosa_real]

Hi, mstjohn_splunk.

So let's say in a production environment, where multiple assets from different contexts send logs to Splunk (Mainframe, Windows event viewer, Linux, Apache web servers, application servers, switches, routers or firewalls). These Configuration Items (ICs) are dependent on each other, and when an incident occurs in one of these assets that is shown in a dependency tree format, something like a topology, as in the link example.

http://docs.splunk.com/Documentation/VMW/3.4.2/User/ProactiveMonitoring

Thanks for listening.

[mstjohn_splunk]

thanks @jfeitosa_real,

I went ahead and moved your comment up to the question so that it has better visibility.

Good luck with your query!

[jfeitosa_real]

Thank you very much