Sankey - Visualization type

[jaibalaraman]

Hi Team 

Is there any way to create Sankey style tile for a single value , below image explaing abt group value.

Where i would like to break into single like Account locked , Invalid Login in separate tile 

jaibalaraman_0-1723175709660.png

[tscroggins]

Hi @jaibalaraman,

You can use multiple Sankey visualizations to display a single source-target-value combination, or you can create mock visualizations using boxes, text, and a single-value visualization.

In this Splunk 9.3 example, I've used three adjacent boxes, with the center box having 50% transparency. A markdown element is placed over the center box to provide the text, and a single-value element is placed to the right to provide a count.

tscroggins_1-1723395942998.png

In your case, however, 403120 appears to be an event identifier and not a count.

What are you trying to communicate with individual tiles that can't be represented by a Sankey diagram?

[jaibalaraman]

Hi 

I would like to display the count of the error code.

[jaibalaraman]

Also could you please share some example dashboard which you have used

[tscroggins]

Hi @jaibalaraman,

Here's a static example that uses separate elements to display a Sankey-like bar:

{
    "visualizations": {
        "viz_GGlMQrhz": {
            "type": "splunk.rectangle",
            "options": {
                "fillColor": "#5a4575",
                "strokeColor": "#5a4575"
            }
        },
        "viz_sdLspBWZ": {
            "type": "splunk.rectangle",
            "options": {
                "fillColor": "#5a4575",
                "strokeColor": "#5a4575",
                "fillOpacity": 0.5,
                "strokeOpacity": 0.5
            }
        },
        "viz_G2e5COXh": {
            "type": "splunk.rectangle",
            "options": {
                "fillColor": "#0877a6",
                "strokeColor": "#0877a6"
            }
        },
        "viz_izmTEXa4": {
            "type": "splunk.singlevalue",
            "options": {
                "backgroundColor": "transparent",
                "majorFontSize": 20
            },
            "dataSources": {
                "primary": "ds_zydmsUyG"
            }
        },
        "viz_OBDGe1i4": {
            "type": "splunk.markdown",
            "options": {
                "markdown": "****Account Temporarily Locked Out (403120)****",
                "fontSize": "custom",
                "customFontSize": 20
            }
        }
    },
    "dataSources": {
        "ds_zydmsUyG": {
            "type": "ds.search",
            "options": {
                "query": "| stats count\n| eval count=123",
                "queryParameters": {
                    "earliest": "0",
                    "latest": ""
                }
            },
            "name": "Search_1"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "latest": "$global_time.latest$",
                        "earliest": "$global_time.earliest$"
                    }
                }
            }
        }
    },
    "inputs": {
        "input_global_trp": {
            "type": "input.timerange",
            "options": {
                "token": "global_time",
                "defaultValue": "-24h@h,now"
            },
            "title": "Global Time Range"
        }
    },
    "layout": {
        "type": "absolute",
        "options": {
            "width": 1440,
            "height": 960,
            "display": "auto"
        },
        "structure": [
            {
                "item": "viz_GGlMQrhz",
                "type": "block",
                "position": {
                    "x": 0,
                    "y": 0,
                    "w": 20,
                    "h": 70
                }
            },
            {
                "item": "viz_sdLspBWZ",
                "type": "block",
                "position": {
                    "x": 20,
                    "y": 0,
                    "w": 510,
                    "h": 70
                }
            },
            {
                "item": "viz_G2e5COXh",
                "type": "block",
                "position": {
                    "x": 530,
                    "y": 0,
                    "w": 20,
                    "h": 70
                }
            },
            {
                "item": "viz_izmTEXa4",
                "type": "block",
                "position": {
                    "x": 430,
                    "y": 0,
                    "w": 100,
                    "h": 70
                }
            },
            {
                "item": "viz_OBDGe1i4",
                "type": "block",
                "position": {
                    "x": 30,
                    "y": 20,
                    "w": 400,
                    "h": 30
                }
            }
        ],
        "globalInputs": [
            "input_global_trp"
        ]
    },
    "description": "",
    "title": "Sankey-like"
}