Dashboards & Visualizations

How to change node color under condition in Network Diagram Viz?

POR160893
Builder

Hi,

I am using the network diagram viz and I need to change the color of the nodes which also have values for one specific field "SSh".

Here is my current Splunk query 
index=fraud_glassbox (sourcetype="gb:hit" OR sourcetype="gb:sessions") 44ead780-cf74-11ec-915e-005056b040ae
| eval time_epoch = strptime('SESSION_TIMESTAMP', "%Y-%m-%d %H:%M:%S")
| convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M"
| eval SEQUENCEto = tonumber(SEQUENCE) + 1
| strcat URL_PATH ":" SEQUENCE from
| autoregress from as to
| eval color = "red"
| table from, to, color,Premier_RC_Code_SSH

and output:

POR160893_0-1652301312298.png

 



Is it possible to incorporate an IF-like statement or subsearch that would turn all such nodes blue if there is respective values for "SSH" field?

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use if in the eval statement

| eval color=if(match(field, "match_regex"), "custom_colour", "red")

where 'field' is the field you want to test for matching data and the regex is the match string you're looking for.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...