Dashboards & Visualizations

How to change node color under condition in Network Diagram Viz?

POR160893
Contributor

Hi,

I am using the network diagram viz and I need to change the color of the nodes which also have values for one specific field "SSh".

Here is my current Splunk query 
index=fraud_glassbox (sourcetype="gb:hit" OR sourcetype="gb:sessions") 44ead780-cf74-11ec-915e-005056b040ae
| eval time_epoch = strptime('SESSION_TIMESTAMP', "%Y-%m-%d %H:%M:%S")
| convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M"
| eval SEQUENCEto = tonumber(SEQUENCE) + 1
| strcat URL_PATH ":" SEQUENCE from
| autoregress from as to
| eval color = "red"
| table from, to, color,Premier_RC_Code_SSH

and output:

POR160893_0-1652301312298.png

 



Is it possible to incorporate an IF-like statement or subsearch that would turn all such nodes blue if there is respective values for "SSH" field?

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use if in the eval statement

| eval color=if(match(field, "match_regex"), "custom_colour", "red")

where 'field' is the field you want to test for matching data and the regex is the match string you're looking for.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...