Dashboards & Visualizations

Visualization to show hops between two servers

sairam1444
Engager

Hi,

I got data like this, which will show hop server between two destinations and certain metrics between them 

source,final_destination,hop_number,hop_host,loss_perc
1.1.1.1,4.4.4.4,1,2.2.2.2,3
1.1.1.1,4.4.4.4,2,3.3.3.3,2

So I wanna show a visualization which shows like this


1.1.1.1. ( source ) ----- 3 ( loss perc ) -------> 2.2.2.2 ----2 ( loss perc ) ------> 3.3.3.3 -------> 4.4.4.4 ( final destination ) 

@niketn 

Labels (2)
0 Karma

rnowitzki
Builder

Hi @sairam1444,

I guess there can be more than 2 lines (=hops) for each source/destination pair, correct?
And the data will have multiple sources and destinations, right?

Do you have any requirement for the visualization? I guess to put together a long string as you provided would be not a big issue (with strcat e.g.), but does it need to be "more visual" somehow. With colors based on the values, boxes around the values...fancy arrows? Basically: Is it for a Management or Operations audience? 🙂

BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval events="1.1.1.1,4.4.4.4,1,2.2.2.2,3|1.1.1.1,4.4.4.4,2,3.3.3.3,2"
| eval events=split(events,"|")
| mvexpand events
| rex field=events "(?<source>[^,]+),(?<dest>[^,]+),(?<hop>[^,]+),(?<hop_host>[^,]+),(?<hop_perc>.*)"
| fields - events
| eval hop_host_field="hop_".hop."_host"
| eval hop_perc_field="hop_".hop."__perc"
| eval {hop_host_field}=hop_host
| eval {hop_perc_field}=hop_perc
| fields - hop_host hop_perc hop hop_host_field hop_perc_field
| stats values(*) as * by source, dest
| fields source hop* dest
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...