Hi @polak
Yes you can do either of these things. When you produce the table of data for this viz, each row should be either a node row (has a column called "node") or it should be a path row (either a column called "path" or columns "from" and "to"). Depending on if you want to color paths or nodes, then for either case make sure you include a column called "color" with either a friendly HTML color name (e.g. "red") or another HTML color spec (e.g. #FF0000)
I hope this makes sense. Its a bit confusing compared to normal visualizations.
here is a sample search you can run as an example:
|makeresults count=3
| streamstats count as rowid
| eval path = case(rowid==1,"a---b---c",rowid==2,"c---d",true(),"")
| eval node = if(rowid==3,"b","")
| eval color = case(rowid==1,"red",rowid==2,"green",true(),"orange")
Examine the tabular output of this, then test it with the vis to see what has changed.
All the best,
... View more