Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Force Directed App For Splunk
SHA256 checksum (force-directed-app-for-splunk_200.tgz) 0b21dc8a7eb849d0f685366fa3de7d16e7096cb84f3c35d82f662e3542cd5f1c SHA256 checksum (force-directed-app-for-splunk_103.tgz) 5695adf2693b548c9370179f82763e0923cba0d2af0fd1c309c617d99cddafff
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Force Directed App For Splunk

Overview
Details
Have you ever wanted to graph out attack paths? Or review links in your data. The Force Directed App For Splunk helps you do this. Built on D3 this app will allow you to search any form of data that has a source and target.

Force Directed App For Splunk

This app was created to allow IT Operations administrators and the security team to visualize there networks, attack paths inside an environment, connections between objects. The limits are endless. Some of the features that are supported in this app are

  • Customisation to Attract and Repel Forces
  • Selectable Dark and White Theme
  • Automatic Grouping and colouring of nodes
  • Customisation to collision forces to avoid overlapping

Also some great references for D3 below.

https://roshansanthosh.wordpress.com/2016/09/25/forces-in-d3-js-v4/
https://github.com/d3/d3-force/blob/master/README.md
https://vega.github.io/vega/docs/transforms/force/

Installation Instructions

  1. Download the app and unzip to $SPLUNK_HOME/etc/apps on your Search Head
  2. Restart Splunk
  3. Generate a search that has a 'source', 'target' and optionally a count.

Search Examples

Standard Source Destination Search

- index=firewall action=allowed stats count by src_ip, dest_ip

Multi Relationship Mapping

This option allows you to add as many tiers of relationship mapping as neccessary. Ensure that the number format is in XX rather than X. For example node1 will not work, but node01 will work.
- index=firewall action=allowed | stats count by src_ip, dest_ip, dest_port | rename src_ip as node00, dest_ip as node01, dest_port as node03
- index=os | stats count by hardware, operatingsystem, asset_name | rename hardware as node00, operatingsystem as node01, asset_name as node03
- Tested up to 5 nodes.

Configuration Options

Format

  1. Theme Color - Changes background image color
  2. Arrows - Enables direction arrows in force directed visualization
  3. Line Stroke Width - Changes the width of the lines connecting nodes
  4. Link Highlight Length - This number affects how many node children are higlighted when you mouseover a node. i.e If you select '2' and hover over a node. Its connected nodes are highlighted and children of those.
  5. Circle Radius - This will change the size in pixels of the circle
  6. Pan/Zoom - This will enable pan/zoom. Defaults to disable and is best used with embedded reports.

Force Configuration

  1. Attract Force Strength - Strength of Attracting forces.
  2. Attract Distance Max - The maximum distance over which attraction force acts. If two nodes exceed distanceMax, they will not exert forces on each other.
  3. Attract Distance Min - The minimum distance over which attraction force acts. If two nodes are close than distanceMin, the exerted forces will be as if they are distanceMin apart.
  4. Repel Force Strength - Strength of Repelling force
  5. Repel Distance Max - The maximum distance over which repel force acts. If two nodes exceed distanceMax, they will not exert forces on each other.
  6. Repel Distance Min - The minimum distance over which repel force acts. If two nodes exceed distanceMax, they will not exert forces on each other.
  7. Link Distance - The shortest distance between nodes in a link.

Collision Configuration

  1. Collision Strength - How strict collision mechanism is
  2. Collision Radius - The radius between a center of each node that can't be overlapped with each other
  3. Force Collide - Superfluous setting
  4. Collision Iterations - The number of times to

Bugs / Features

If you identify any bugs or have feature requests please either contact me via twitter @MickeyPerre or post a topic under 'Questions on Splunk Answers' :)

Known - Arrows not working in IE11. This is a bug in IE not the code. To make the code flexible to exclude and include arrows I could not make this work.

Please report any other bugs to this page. I accept pull requests.

Tested on

Mac
- Safari Version 11.0
- Chrome Version 61.0.X (Official Build) (64-bit)
- Firefox 64.0

Windows Server 2012
- Internet Explorer 11

License

This app uses D3 with the following license conditions
https://github.com/d3/d3/blob/master/LICENSE

Release Notes

Version 2.0.0
May 25, 2018

- Removed vulnerable version dependency
- Added option under format to enable and disable pan/zoom
- Created multi relationship force
- Ability to change circle size
- Configuration change to allow link size adjustments
- Code improvement and re-ordering

Version 1.0.3
Nov. 1, 2017

Updated Readme and app version

487
Installs
1,421
Downloads
Share Subscribe LOGIN TO DOWNLOAD

Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 50GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2018 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.