Dashboards & Visualizations

Visualization to show hops between two servers

sairam1444
Engager

Hi,

I got data like this, which will show hop server between two destinations and certain metrics between them 

source,final_destination,hop_number,hop_host,loss_perc
1.1.1.1,4.4.4.4,1,2.2.2.2,3
1.1.1.1,4.4.4.4,2,3.3.3.3,2

So I wanna show a visualization which shows like this


1.1.1.1. ( source ) ----- 3 ( loss perc ) -------> 2.2.2.2 ----2 ( loss perc ) ------> 3.3.3.3 -------> 4.4.4.4 ( final destination ) 

@niketn 

Labels (2)
0 Karma

rnowitzki
Builder

Hi @sairam1444,

I guess there can be more than 2 lines (=hops) for each source/destination pair, correct?
And the data will have multiple sources and destinations, right?

Do you have any requirement for the visualization? I guess to put together a long string as you provided would be not a big issue (with strcat e.g.), but does it need to be "more visual" somehow. With colors based on the values, boxes around the values...fancy arrows? Basically: Is it for a Management or Operations audience? 🙂

BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval events="1.1.1.1,4.4.4.4,1,2.2.2.2,3|1.1.1.1,4.4.4.4,2,3.3.3.3,2"
| eval events=split(events,"|")
| mvexpand events
| rex field=events "(?<source>[^,]+),(?<dest>[^,]+),(?<hop>[^,]+),(?<hop_host>[^,]+),(?<hop_perc>.*)"
| fields - events
| eval hop_host_field="hop_".hop."_host"
| eval hop_perc_field="hop_".hop."__perc"
| eval {hop_host_field}=hop_host
| eval {hop_perc_field}=hop_perc
| fields - hop_host hop_perc hop hop_host_field hop_perc_field
| stats values(*) as * by source, dest
| fields source hop* dest
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...