Dashboards & Visualizations

Visualization to show hops between two servers

sairam1444
Engager

Hi,

I got data like this, which will show hop server between two destinations and certain metrics between them 

source,final_destination,hop_number,hop_host,loss_perc
1.1.1.1,4.4.4.4,1,2.2.2.2,3
1.1.1.1,4.4.4.4,2,3.3.3.3,2

So I wanna show a visualization which shows like this


1.1.1.1. ( source ) ----- 3 ( loss perc ) -------> 2.2.2.2 ----2 ( loss perc ) ------> 3.3.3.3 -------> 4.4.4.4 ( final destination ) 

@niketn 

Labels (2)
0 Karma

rnowitzki
Builder

Hi @sairam1444,

I guess there can be more than 2 lines (=hops) for each source/destination pair, correct?
And the data will have multiple sources and destinations, right?

Do you have any requirement for the visualization? I guess to put together a long string as you provided would be not a big issue (with strcat e.g.), but does it need to be "more visual" somehow. With colors based on the values, boxes around the values...fancy arrows? Basically: Is it for a Management or Operations audience? 🙂

BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval events="1.1.1.1,4.4.4.4,1,2.2.2.2,3|1.1.1.1,4.4.4.4,2,3.3.3.3,2"
| eval events=split(events,"|")
| mvexpand events
| rex field=events "(?<source>[^,]+),(?<dest>[^,]+),(?<hop>[^,]+),(?<hop_host>[^,]+),(?<hop_perc>.*)"
| fields - events
| eval hop_host_field="hop_".hop."_host"
| eval hop_perc_field="hop_".hop."__perc"
| eval {hop_host_field}=hop_host
| eval {hop_perc_field}=hop_perc
| fields - hop_host hop_perc hop hop_host_field hop_perc_field
| stats values(*) as * by source, dest
| fields source hop* dest
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...