Dashboards & Visualizations

How to change node color under condition in Network Diagram Viz?

POR160893
Builder

Hi,

I am using the network diagram viz and I need to change the color of the nodes which also have values for one specific field "SSh".

Here is my current Splunk query 
index=fraud_glassbox (sourcetype="gb:hit" OR sourcetype="gb:sessions") 44ead780-cf74-11ec-915e-005056b040ae
| eval time_epoch = strptime('SESSION_TIMESTAMP', "%Y-%m-%d %H:%M:%S")
| convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M"
| eval SEQUENCEto = tonumber(SEQUENCE) + 1
| strcat URL_PATH ":" SEQUENCE from
| autoregress from as to
| eval color = "red"
| table from, to, color,Premier_RC_Code_SSH

and output:

POR160893_0-1652301312298.png

 



Is it possible to incorporate an IF-like statement or subsearch that would turn all such nodes blue if there is respective values for "SSH" field?

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use if in the eval statement

| eval color=if(match(field, "match_regex"), "custom_colour", "red")

where 'field' is the field you want to test for matching data and the regex is the match string you're looking for.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...