icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Link Analysis App For Splunk
SHA256 checksum (link-analysis-app-for-splunk_163.tgz) a9323252af3fda382dccf9fb0353f71a0450427437fe2e0f6d60d475cf84b1b2 SHA256 checksum (link-analysis-app-for-splunk_161.tgz) 70b5300a0e9dd305c963f607aee4679eb8769dc75605afbdb0b473b416682d40 SHA256 checksum (link-analysis-app-for-splunk_160.tgz) 9988433722bc48990009715b6bdaa0df3f4d369c49174ec3581cc53b1ebb294d
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Link Analysis App For Splunk

This app is NOT supported by Splunk. Please read about what that means for you here.
The Link Analysis App for Splunk allows you to map out complex relationships using your Splunk data. This is not your typical graph Splunk App.

This app allows you to perform true link analysis such as shortest path selection, dynamic node colouring, state saving and graph filtering. Imagine being able to build complex process trees and identifying patterns in your data that you never knew existed!

Link Analysis App For Splunk

This app provides a seperate visualisation framework for doing force directed visualisation with additional functionality.
For more about the visualisation framework visit here.

Installation Instructions

  1. Download the app and unzip to $SPLUNK_HOME/etc/apps on your Search Head
  2. Restart Splunk
  3. Generate a search that has a 'source', 'target' and optionally a count.

Basic Search Examples

- index=firewall action=allowed stats count by src_ip, dest_ip

Extended Search Examples

Optional Fields

  • line_label - To specify the line label of an edge
    index=firewall action=allowed | stats count by src_ip, dest_ip, dest_port | rename dest_port as line_label
    Will make the destination port the line label
  • line_color - To specify a color of an edge
    index=firewall action=allowed | stats count by src_ip, dest_ip | eval line_color=if(count>10,"red","green"
    If count is greater than 10 make the line red else make it green.
  • remove - For huge graphs, it is often faster to remove all nodes off of the graph and start with only one node on the graph. All nodes that have any children can be expanded from here.
    index=firewall action=allowed | stats count by src_ip, dest_ip | eval remove="
    Remove all nodes from the graph except, if is clicked the children will be re-added to the graph
  • preFilter - Allows you to prefilter your graph and remove all nodes that are connected to the node specified in the field.
    Delete all nodes from the graph that are not children of

Configuration Options

Format Menu - Vizualization Style

Layout Style

Layout styles allow you to change the format of the graph. Not every format is useful for every data type. Test with all of the layouts. Some are also faster than others (Grid is the fastest)
- FCose (Default)
- Grid
- Circle
- Klay
- Dagre
- Concentric
- Breadthfirst
- Spread
- Cose

Path Selection Algorithm

This app allows you to build paths between nodes. The path algorithm is customisable to give you different outcomes.
- Dijikstra (Default)
- aStar
- floydWarshall
- bellmanFord

Path Selection Directed

When performing path highlighting, you can honor the direction of the path by selecting true. So in the following scenario if you wanted to map a path from A through to C in the following A:B B:C setting this setting to False would allow the path to be created.
- True
- False (Default)

Node Selection Options

If you click and hold on a node, a context relevant menu will pop-up with the following options.
- Hlt All Paths (Highlight All Paths)
This option allows you to highlight all paths from the node recursively honoring the direction set in the format menu. It will add a highlighted class to the nodes selected
- Single Path Select
This option allows you to draw a single path using the Algorithm in the format menu and honoring the direction set. To use this option, press and hold on the starting node and select Single Path Select then click and hold the target node and select Single Path Select. If a path can be found the nodes will be highlighted.
- Condense
The condense option will condense the immediate children around the selected node in a concentric layout
- Focus
Same as condense. But with a reset button.

Core Selection Options

If you click and hold in blank space on the node, a context relevant menu will pop-up with the following options.
- Menu
Brings up an additional menu with the following options
- Clear Formatting - Removes the highlighted class from all nodes
- Delete Highlighted Items - Remove all highlighted items
- Delete Non Highlighted Items - Remove all non highlighted items
- Refresh - Refreshes the layout, useful when you have removed nodes and want the layout to be recomputed.
- Save State - Allows you to save the state of the graph. Please read save state below.
- Search Edges - Allows you to enter a single term and a color to modify the style of the edge with that value
- Search Nodes - Allows you to find a node on the graph and zoom into the node.

Save State

An option exists in the framework to allow you to save the state of the graph. This becomes really useful when you want to share your view with another analyst. Before doing this you need to have the following.
- HTTP Event Collector Configured with an index of cyto
- A valid certificate for your HTTP Event Collector
- CORS Configured to allow requests
This call is performed via javascript so requires something similar to the following setup.

Bugs / Missing Docos

Please report any bugs to github, Splunk Answers or alternatively hit me up on twitter @MickeyPerre

Feature Requests

Post any feature requests as issues and I will look around to them. My only feedback prior to making feature requests is ensuring that the feature does not reduce the flexibility of the app :).

Tested on



  • This app uses D3 with the following license conditions
  • This app uses Cytoscape js with the following license conditions
  • This app uses the FCose Layout that was created after research with the following paper

Release Notes

Version 1.6.3
July 1, 2020

Fixed bug that prevented two link analysis visualisations from being seen on one page. Added a feature to set a token on a dashboard from what was clicked. Probably something else that I cant remember :)

Version 1.6.1
Nov. 3, 2019

Fixed truncation issues with Save State json output
Updated Search Edges to 'Style Edges' to reflect the true meaning
Fixed the historical link analysis view to ensure that the lookup and change of menu items updated the visualisation.

Version 1.6.0
Oct. 18, 2019

Updated released for .conf

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.