Dashboards & Visualizations

How to change node color under condition in Network Diagram Viz?

POR160893
Builder

Hi,

I am using the network diagram viz and I need to change the color of the nodes which also have values for one specific field "SSh".

Here is my current Splunk query 
index=fraud_glassbox (sourcetype="gb:hit" OR sourcetype="gb:sessions") 44ead780-cf74-11ec-915e-005056b040ae
| eval time_epoch = strptime('SESSION_TIMESTAMP', "%Y-%m-%d %H:%M:%S")
| convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M"
| eval SEQUENCEto = tonumber(SEQUENCE) + 1
| strcat URL_PATH ":" SEQUENCE from
| autoregress from as to
| eval color = "red"
| table from, to, color,Premier_RC_Code_SSH

and output:

POR160893_0-1652301312298.png

 



Is it possible to incorporate an IF-like statement or subsearch that would turn all such nodes blue if there is respective values for "SSH" field?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use if in the eval statement

| eval color=if(match(field, "match_regex"), "custom_colour", "red")

where 'field' is the field you want to test for matching data and the regex is the match string you're looking for.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...