Network Diagram Viz Grouping Issues

[MaxJ]

I have a table with hundreds of thousands of rows which I am seeking to visualise in Splunk.

The data is far too big for the Network Viz diagram to show without latency issues so I am seeking to group it down and will chunk it further with filters. Users are mainly interested in the services we have and how they connect with other services through our assets. Details like server names are less important so those can be grouped.

I am having issues with the default network viz diagram and the grouping behaviour. 

Example Data:

Parent	Child	Parent Class	Child Class
Service1	Service2	Service	Service
Server1	Server2	Server	Server
Server2	Server3	Server	Server
Service1	Server3	Service	Server
Service2	Server2	Service	Server
Service3	Server4	Service	Server
Service1	Database1	Service	Database
Service3	Database1	Service	Database
Service3	Database2	Service	Database
Server3	Network1	Server	Network
Server4	Network1	Server	Network

Desired look below. Notice how there are multiple server groups rather than just one. We can clearly identify that service 1 and 2 are linked through servers. Service 3 is separate and is connected to a different group of servers.

And here is my attempt at using the group functionality for the network viz diagram. I used the asset class to make colour groupings. Notice that the groups are just generic and cannot be named. All servers have been grouped together making it look like all 3 services are linked through servers.  

Expanding this diagram clearly shows they are not linked through servers. Service 3 is connected to a different server.

Is there a way to reach my desired grouping method with the default Splunk tools? Is there another add on I could utilise?

[bowesmana]

Maybe you can share your current search that does this grouping.

What's your logic for deciding that server 2 and server 3 need to be in a different server group to server 4, is it simply on the presence of a connection between those 2 services?

@danspav 

[MaxJ]

The logic for the groupings is that service 1 and 2 share the same servers. service 3 uses different servers. Therefore if there was an issue with those servers we could see how many services would be affected. I am trying to abridge the data but still show those specific dependencies between services where they have a lot of shared assets.

[MaxJ]

This is an example of the dashboard using the groupings based on colours. The first panel without grouping, second one is with.

dashboard version="1.1" theme="light">
<label>Network Viz Groupings Test</label>
<row>
<panel>
<title>Network Viz No Groups</title>
<viz type="network-diagram-viz.network-diagram-viz">
<search>
<query>| makeresults
| eval _raw="
'Child Class','Parent Class','from','to'
Database,Service,Service1,Database1
Database,Service,Service3,Database1
Database,Service,Service3,Database2
Network,Server,Server3,Network1
Network,Server,Server4,Network1
Server,Server,Server1,Server2
Server,Server,Server2,Server3
Server,Service,Service1,Server3
Server,Service,Service2,Server2
Server,Service,Service3,Server4
Service,Service,Service1,Service2
"
| multikv forceheader=1
| fields - _raw, _time, linecount
| rename "Parent_Class_" as "Parent Class", "Child_Class_" as "Child Class", from_ as from, to_ as to
```Logic used for color grouping```
| eval color=case('Parent Class'=="Service", "red", 'Parent Class'=="Server", "green",0==0, black)</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</viz>
</panel>
</row>
<row>
<panel>
<title>Network Viz Grouped By Colour</title>
<viz type="network-diagram-viz.network-diagram-viz">
<search>
<query>| makeresults
| eval _raw="
'Child Class','Parent Class','from','to'
Database,Service,Service1,Database1
Database,Service,Service3,Database1
Database,Service,Service3,Database2
Network,Server,Server3,Network1
Network,Server,Server4,Network1
Server,Server,Server1,Server2
Server,Server,Server2,Server3
Server,Service,Service1,Server3
Server,Service,Service2,Server2
Server,Service,Service3,Server4
Service,Service,Service1,Service2
"
| multikv forceheader=1
| fields - _raw, _time, linecount
| rename "Parent_Class_" as "Parent Class", "Child_Class_" as "Child Class", from_ as from, to_ as to
```Logic used for color grouping```
| eval color=case('Parent Class'=="Service", "red", 'Parent Class'=="Server", "green",0==0, black)</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="network-diagram-viz.network-diagram-viz.arrowLocation">none</option>
<option name="network-diagram-viz.network-diagram-viz.canZoom">true</option>
<option name="network-diagram-viz.network-diagram-viz.clusterBy">color</option>
<option name="network-diagram-viz.network-diagram-viz.defaultLinkLength">100</option>
<option name="network-diagram-viz.network-diagram-viz.defaultNodeType">circle</option>
<option name="network-diagram-viz.network-diagram-viz.draggableNodes">true</option>
<option name="network-diagram-viz.network-diagram-viz.drilldownClick">singleOrDouble</option>
<option name="network-diagram-viz.network-diagram-viz.enablePhysics">true</option>
<option name="network-diagram-viz.network-diagram-viz.hierarchy">false</option>
<option name="network-diagram-viz.network-diagram-viz.hierarchyDirection">Top-Down</option>
<option name="network-diagram-viz.network-diagram-viz.hierarchySortMethod">directed</option>
<option name="network-diagram-viz.network-diagram-viz.levelSeparation">150</option>
<option name="network-diagram-viz.network-diagram-viz.linkTextLocation">bottom</option>
<option name="network-diagram-viz.network-diagram-viz.linkTextSize">medium</option>
<option name="network-diagram-viz.network-diagram-viz.missingImageURL">/static/app/network-diagram-viz/customimages/404.gif</option>
<option name="network-diagram-viz.network-diagram-viz.nodeSpacing">100</option>
<option name="network-diagram-viz.network-diagram-viz.nodeTextSize">medium</option>
<option name="network-diagram-viz.network-diagram-viz.physicsModel">forceAtlas2Based</option>
<option name="network-diagram-viz.network-diagram-viz.shakeTowards">roots</option>
<option name="network-diagram-viz.network-diagram-viz.smoothEdgeType">dynamic</option>
<option name="network-diagram-viz.network-diagram-viz.smoothEdges">true</option>
<option name="network-diagram-viz.network-diagram-viz.tokenNode">nd_node_token</option>
<option name="network-diagram-viz.network-diagram-viz.tokenToNode">nd_to_node_token</option>
<option name="network-diagram-viz.network-diagram-viz.tokenToolTip">nd_tooltip_token</option>
<option name="network-diagram-viz.network-diagram-viz.tokenValue">nd_value_token</option>
<option name="network-diagram-viz.network-diagram-viz.wrapNodeText">true</option>
<option name="refresh.display">progressbar</option>
</viz>
</panel>
</row>


</dashboard><