×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
MaxJ
New Member
Member since: ‎11-08-2022
‎02-17-2025
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎11-08-2022
Activity Feed
View All

Re: Network Diagram Viz Grouping Issues

by in Dashboards & Visualizations
‎02-17-2025 03:06 AM
‎02-17-2025 03:06 AM
The logic for the groupings is that service 1 and 2 share the same servers. service 3 uses different servers. Therefore if there was an issue with those servers we could see how many services would be affected. I am trying to abridge the data but still show those specific dependencies between services where they have a lot of shared assets. ... View more

Re: Network Diagram Viz Grouping Issues

by in Dashboards & Visualizations
‎02-17-2025 03:02 AM
‎02-17-2025 03:02 AM
This is an example of the dashboard using the groupings based on colours. The first panel without grouping, second one is with. dashboard version="1.1" theme="light"> <label>Network Viz Groupings Test</label> <row> <panel> <title>Network Viz No Groups</title> <viz type="network-diagram-viz.network-diagram-viz"> <search> <query>| makeresults | eval _raw=" 'Child Class','Parent Class','from','to' Database,Service,Service1,Database1 Database,Service,Service3,Database1 Database,Service,Service3,Database2 Network,Server,Server3,Network1 Network,Server,Server4,Network1 Server,Server,Server1,Server2 Server,Server,Server2,Server3 Server,Service,Service1,Server3 Server,Service,Service2,Server2 Server,Service,Service3,Server4 Service,Service,Service1,Service2 " | multikv forceheader=1 | fields - _raw, _time, linecount | rename "Parent_Class_" as "Parent Class", "Child_Class_" as "Child Class", from_ as from, to_ as to ```Logic used for color grouping``` | eval color=case('Parent Class'=="Service", "red", 'Parent Class'=="Server", "green",0==0, black)</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </viz> </panel> </row> <row> <panel> <title>Network Viz Grouped By Colour</title> <viz type="network-diagram-viz.network-diagram-viz"> <search> <query>| makeresults | eval _raw=" 'Child Class','Parent Class','from','to' Database,Service,Service1,Database1 Database,Service,Service3,Database1 Database,Service,Service3,Database2 Network,Server,Server3,Network1 Network,Server,Server4,Network1 Server,Server,Server1,Server2 Server,Server,Server2,Server3 Server,Service,Service1,Server3 Server,Service,Service2,Server2 Server,Service,Service3,Server4 Service,Service,Service1,Service2 " | multikv forceheader=1 | fields - _raw, _time, linecount | rename "Parent_Class_" as "Parent Class", "Child_Class_" as "Child Class", from_ as from, to_ as to ```Logic used for color grouping``` | eval color=case('Parent Class'=="Service", "red", 'Parent Class'=="Server", "green",0==0, black)</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="network-diagram-viz.network-diagram-viz.arrowLocation">none</option> <option name="network-diagram-viz.network-diagram-viz.canZoom">true</option> <option name="network-diagram-viz.network-diagram-viz.clusterBy">color</option> <option name="network-diagram-viz.network-diagram-viz.defaultLinkLength">100</option> <option name="network-diagram-viz.network-diagram-viz.defaultNodeType">circle</option> <option name="network-diagram-viz.network-diagram-viz.draggableNodes">true</option> <option name="network-diagram-viz.network-diagram-viz.drilldownClick">singleOrDouble</option> <option name="network-diagram-viz.network-diagram-viz.enablePhysics">true</option> <option name="network-diagram-viz.network-diagram-viz.hierarchy">false</option> <option name="network-diagram-viz.network-diagram-viz.hierarchyDirection">Top-Down</option> <option name="network-diagram-viz.network-diagram-viz.hierarchySortMethod">directed</option> <option name="network-diagram-viz.network-diagram-viz.levelSeparation">150</option> <option name="network-diagram-viz.network-diagram-viz.linkTextLocation">bottom</option> <option name="network-diagram-viz.network-diagram-viz.linkTextSize">medium</option> <option name="network-diagram-viz.network-diagram-viz.missingImageURL">/static/app/network-diagram-viz/customimages/404.gif</option> <option name="network-diagram-viz.network-diagram-viz.nodeSpacing">100</option> <option name="network-diagram-viz.network-diagram-viz.nodeTextSize">medium</option> <option name="network-diagram-viz.network-diagram-viz.physicsModel">forceAtlas2Based</option> <option name="network-diagram-viz.network-diagram-viz.shakeTowards">roots</option> <option name="network-diagram-viz.network-diagram-viz.smoothEdgeType">dynamic</option> <option name="network-diagram-viz.network-diagram-viz.smoothEdges">true</option> <option name="network-diagram-viz.network-diagram-viz.tokenNode">nd_node_token</option> <option name="network-diagram-viz.network-diagram-viz.tokenToNode">nd_to_node_token</option> <option name="network-diagram-viz.network-diagram-viz.tokenToolTip">nd_tooltip_token</option> <option name="network-diagram-viz.network-diagram-viz.tokenValue">nd_value_token</option> <option name="network-diagram-viz.network-diagram-viz.wrapNodeText">true</option> <option name="refresh.display">progressbar</option> </viz> </panel> </row> </dashboard><    ... View more

Network Diagram Viz Grouping Issues

by in Dashboards & Visualizations
‎02-17-2025 01:11 AM
‎02-17-2025 01:11 AM
I have a table with hundreds of thousands of rows which I am seeking to visualise in Splunk. The data is far too big for the Network Viz diagram to show without latency issues so I am seeking to group it down and will chunk it further with filters. Users are mainly interested in the services we have and how they connect with other services through our assets. Details like server names are less important so those can be grouped. I am having issues with the default network viz diagram and the grouping behaviour.  Example Data: Parent Child Parent Class Child Class Service1 Service2 Service Service Server1 Server2 Server Server Server2 Server3 Server Server Service1 Server3 Service Server Service2 Server2 Service Server Service3 Server4 Service Server Service1 Database1 Service Database Service3 Database1 Service Database Service3 Database2 Service Database Server3 Network1 Server Network Server4 Network1 Server Network   Desired look below. Notice how there are multiple server groups rather than just one. We can clearly identify that service 1 and 2 are linked through servers. Service 3 is separate and is connected to a different group of servers. And here is my attempt at using the group functionality for the network viz diagram. I used the asset class to make colour groupings. Notice that the groups are just generic and cannot be named. All servers have been grouped together making it look like all 3 services are linked through servers.   Expanding this diagram clearly shows they are not linked through servers. Service 3 is connected to a different server. Is there a way to reach my desired grouping method with the default Splunk tools? Is there another add on I could utilise? ... View more
Labels

savedsearch vs outputlookup- Which one is more eff...

by in Splunk Search
‎11-08-2022 05:03 AM
‎11-08-2022 05:03 AM
I run large searches at the start of each month. Generally I use the saved search commands to retrieve the results on dashboards - e.g. | savedsearch report_name. However, we sometimes use outputlookup at the end of the search and inputlookup to retrieve the data on the dashboard - e.g. | outputlookup report_file.csv.  I have recently had some issues with saved search: jobs being deleted that causes my saved searches disappear For saved searches to be refreshed the report needs to rescheduled and run again Odd behaviour with reports running but data not actually being picked up by dashboards These issues do not apply to outputlookup reports which can more easily be re-run and also can easily be edited with lookup editor if required. Can anybody tell me which is more efficient to use and should be the default option? Are there any advantages and disadvantages to either command I have not considered?   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎02-17-2025 07:42 AM