Hi,
I got data like this, which will show hop server between two destinations and certain metrics between them
source,final_destination,hop_number,hop_host,loss_perc
1.1.1.1,4.4.4.4,1,2.2.2.2,3
1.1.1.1,4.4.4.4,2,3.3.3.3,2
So I wanna show a visualization which shows like this
1.1.1.1. ( source ) ----- 3 ( loss perc ) -------> 2.2.2.2 ----2 ( loss perc ) ------> 3.3.3.3 -------> 4.4.4.4 ( final destination )
Hi @sairam1444,
I guess there can be more than 2 lines (=hops) for each source/destination pair, correct?
And the data will have multiple sources and destinations, right?
Do you have any requirement for the visualization? I guess to put together a long string as you provided would be not a big issue (with strcat e.g.), but does it need to be "more visual" somehow. With colors based on the values, boxes around the values...fancy arrows? Basically: Is it for a Management or Operations audience? 🙂
BR
Ralph
| makeresults | eval events="1.1.1.1,4.4.4.4,1,2.2.2.2,3|1.1.1.1,4.4.4.4,2,3.3.3.3,2"
| eval events=split(events,"|")
| mvexpand events
| rex field=events "(?<source>[^,]+),(?<dest>[^,]+),(?<hop>[^,]+),(?<hop_host>[^,]+),(?<hop_perc>.*)"
| fields - events
| eval hop_host_field="hop_".hop."_host"
| eval hop_perc_field="hop_".hop."__perc"
| eval {hop_host_field}=hop_host
| eval {hop_perc_field}=hop_perc
| fields - hop_host hop_perc hop hop_host_field hop_perc_field
| stats values(*) as * by source, dest
| fields source hop* dest