icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

Thank You

Downloading Force Directed App For Splunk
SHA256 checksum (force-directed-app-for-splunk_310.tgz) 9bb4a31c539d11a9206067c1e425b699a5382981306484fdb1e568e3649636f8 SHA256 checksum (force-directed-app-for-splunk_303.tgz) f041d9d832f0125d376c6dc68bffde88eead82f2c3a1a2b66ddf8f55cd0654c2 SHA256 checksum (force-directed-app-for-splunk_301.tgz) 0471641e21cb15b3171db5d78984f8e8f357e42b378da52ba6d0bc5e834be37c SHA256 checksum (force-directed-app-for-splunk_200.tgz) 0b21dc8a7eb849d0f685366fa3de7d16e7096cb84f3c35d82f662e3542cd5f1c SHA256 checksum (force-directed-app-for-splunk_103.tgz) 5695adf2693b548c9370179f82763e0923cba0d2af0fd1c309c617d99cddafff
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Force Directed App For Splunk

Splunk Cloud
Splunk Built
Have you ever wanted to graph out attack paths? Or review links in your data. The Force Directed App For Splunk helps you do this. Built on D3 this app will allow you to search any form of data that has a source and target.

Force Directed App For Splunk

This app was created to allow IT Operations administrators and the security team to visualize there networks, attack paths inside an environment, connections between objects. The limits are endless. Some of the features that are supported in this app are

  • Customisation to Attract and Repel Forces
  • Selectable Dark and White Theme
  • Automatic Grouping and colouring of nodes
  • Customisation to collision forces to avoid overlapping

Also some great references for D3 below.


Installation Instructions

  1. Download the app and unzip to $SPLUNK_HOME/etc/apps on your Search Head
  2. Restart Splunk
  3. Generate a search that has a 'source', 'target' and optionally a count.

Search Examples

Standard Source Destination Search

- index=firewall action=allowed stats count by src_ip, dest_ip

Multi Relationship Mapping

This option allows you to add as many tiers of relationship mapping as neccessary. Ensure that the number format is in XX rather than X. For example node1 will not work, but node01 will work.
- index=firewall action=allowed | stats count by src_ip, dest_ip, dest_port | rename src_ip as node00, dest_ip as node01, dest_port as node03
- index=os | stats count by hardware, operatingsystem, asset_name | rename hardware as node00, operatingsystem as node01, asset_name as node03
- Tested up to 5 nodes.

Configuration Options


  1. Theme Color - Changes background image color
  2. Arrows - Enables direction arrows in force directed visualization
  3. Line Stroke Width - Changes the width of the lines connecting nodes
  4. Link Highlight Length - This number affects how many node children are higlighted when you mouseover a node. i.e If you select '2' and hover over a node. Its connected nodes are highlighted and children of those.
  5. Circle Radius - This will change the size in pixels of the circle
  6. Pan/Zoom - This will enable pan/zoom. Defaults to disable and is best used with embedded reports.

Force Configuration

  1. Attract Force Strength - Strength of Attracting forces.
  2. Attract Distance Max - The maximum distance over which attraction force acts. If two nodes exceed distanceMax, they will not exert forces on each other.
  3. Attract Distance Min - The minimum distance over which attraction force acts. If two nodes are close than distanceMin, the exerted forces will be as if they are distanceMin apart.
  4. Repel Force Strength - Strength of Repelling force
  5. Repel Distance Max - The maximum distance over which repel force acts. If two nodes exceed distanceMax, they will not exert forces on each other.
  6. Repel Distance Min - The minimum distance over which repel force acts. If two nodes exceed distanceMax, they will not exert forces on each other.
  7. Link Distance - The shortest distance between nodes in a link.

Collision Configuration

  1. Collision Strength - How strict collision mechanism is
  2. Collision Radius - The radius between a center of each node that can't be overlapped with each other
  3. Force Collide - Superfluous setting
  4. Collision Iterations - The number of times to

Bugs / Features

If you identify any bugs or have feature requests please either contact me via twitter @MickeyPerre or post a topic under 'Questions on Splunk Answers' :)

Known - Arrows not working in IE11. This is a bug in IE not the code. To make the code flexible to exclude and include arrows I could not make this work.

Please report any other bugs to this page. I accept pull requests.

Tested on

- Safari Version 11.0
- Chrome Version 61.0.X (Official Build) (64-bit)
- Firefox 64.0

Windows Server 2012
- Internet Explorer 11


This app uses D3 with the following license conditions

Release Notes

Version 3.1.0
June 25, 2021
Version 3.0.3
July 1, 2020

Updated app.manifest to fix cloud issues.

Version 3.0.1
April 1, 2019

Lots of updates. Read the documentation and get excited!!

Version 2.0.0
May 25, 2018
  • Removed vulnerable version dependency
  • Added option under format to enable and disable pan/zoom
  • Created multi relationship force
  • Ability to change circle size
  • Configuration change to allow link size adjustments
  • Code improvement and re-ordering
Version 1.0.3
Nov. 1, 2017

Updated Readme and app version

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.