Hi @ajayabburi508 I would be happy to help you but I don't really understand the question. What do you mean by a "straight flow"? You can drag the elements into a straight line if you like and then save their positions using the formatting menu. Please provide some extra details so I can help you further. All the best, Chris. ... View more

Hi @dbot2001 My apologies for the delay in responding - I was on holidays. This app will work fine on Splunk 7.3. Please let me know if you have found a specific problem because I have been using it without any troubles on 7.3 already. I am working though making it and my other apps compatible with version 8 (python 3) as well but that is taking some time. Thanks for using my app. Cheers ... View more

Hi @nathanluke86 Apologies for the delay in responding, I have been on holidays. Your query looks fine, and there is no problem with using tokens/dropdowns. The only thought I have is that the icons failing to load might happen becuase Splunk takes a bit of extra time to do the subsearch (the append). Lucky there may be a simple fix for this, try replacing teh last line with this instead: |inputlookup append=t path.csv so your whole query would look like this index = iis dest_host=$dest$ src_host_name=$src$ status=* | chart useother=false usenull=false count over src_host_name by status | streamstats count as tmp | untable tmp status count | stats sum(eval(if(like(status,"2%"),count,0))) as good, ,sum(eval(if(like(status,"4%"),count,0))) as error, ,sum(eval(if(like(status,"3%"),count,0))) as warn ,values(eval(if(status=="src_host_name",count,NULL))) as src_host_name by tmp | eval from=src_host_name , to="dest_host" | fields from to error warn good |inputlookup append=t path.csv ... View more

Hi @nathanluke86 Thanks for using my Viz. This query should work: index = iis | stats count(eval(status="404")) as error count(eval(status="200")) as good by dest_ip |eval from="f5" , to=dest_ip |head 100 |table from to good error ... View more

Hi @rijutha, You can offset the labels by supplying the labelx and labely fields in your data. This will allow you to offset the label by a number of pixels from the center point. If you have a bi-directional link its also a good idea to change the attachment points using fromside and toside again, in your data. From the doco: labelx Offset the label left and right from the centre of the line. Measured in pixels. Negative values move left. labely Offset the label up and down from the centre of the line. Measured in pixels. Negative values move up. fromside Specify a custom attachment point on the source node. See note [1] below. toside Specify a custom attachment point on the target node. See note [1] below. [1] fromside / toside: Possible values are top, bottom, right, left. Defaults to the centre of the node. The value can also be specified with a modifier (+/-) to tune where on that side the attachment occurs. For example: "bottom-10" will attach to the bottom side, 10px to the left of center, "top+20" will attach to the top and 20 pixels to the right of center. When using path with multiple nodes, the fromside only affects the first node and the toside only affects the last node. ... View more

Hi @rijutha I am adding limited support for drilldowns very soon, but in the meantime you can go into the formatter options and "Enable HTML labels", then add something like this to the end of your query: |eval label = "<a href='/search/search?q=whatever' target='blank'>My node</a>" I hope you are familiar with HTML 🙂 Also, when you click nodes, some tokens will automatically be set. Hit F12 to open your browser developer tools, then click a node. Messages will be printed to the "Console" saying what tokens are set. Hope this helps. Thanks for using my addon ... View more

hi @bimord I included some examples in the documentation but I admit they are not easy to find. When you are trying to use the visualization, open the "formatting" menu, then click the "Help" tab. On this page you will see a link to in-built documentation which includes two real-world examples, including the one from the youtube page. All the best, and thanks for using my addon! ... View more

Sounds like you might be trying to do chart annotations? Here is an example of how this works: <panel> <title>Events with WARN/ERROR/INFO event annotations and color red for error, orange for warn, green for info</title> <chart> <search type="annotation"> <query> index=_internal (log_level="WARN" OR log_level="ERROR" OR log_level="INFO") | eval annotation_label = message | eval annotation_category = log_level | table _time annotation_label annotation_category </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <search> <query>index=_internal | timechart count</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <!-- Base search that drives the visualization --> <!-- Secondary search that drives the annotations --> <option name="charting.chart">area</option> <option name="charting.drilldown">none</option> <option name="charting.legend.placement">none</option> <!-- Customize the event annotation colors based on category name --> <option name="charting.annotation.categoryColors">{"ERROR":"0xff3300","WARN":"0xff9900","INFO":"0x36b536"}</option> </chart> </panel> https://docs.splunk.com/Documentation/Splunk/7.2.5/Viz/ChartEventAnnotations ... View more

You need to do something like this to get the value into their own fields: index="homeassistant" "attributes.friendly_name"="Temperature Upstairs" OR "attributes.friendly_name"="Temperature Downstairs" | spath | rename attributes.friendly_name as fname | eval temp_up = if(fname=="Temperature Upstairs",value,null()) | eval temp_down = if(fname=="Temperature Downstairs",value,null()) | timechart bins=800 avg(temp_up) as temp_up avg(temp_down) as temp_down ... View more

Its not possible unfortunatly. However using emojii characters might solve your problems! For example you can use this in queries: https://emojipedia.org/heavy-check-mark/ ✔️ ❌ ... View more