This app provides a seperate visualisation framework for doing force directed visualisation with additional functionality.
For more about the visualisation framework visit here.
https://github.com/cytoscape/cytoscape.js
| - index=firewall action=allowed | stats count by src_ip, dest_ip |
|---|
index=firewall action=allowed | stats count by src_ip, dest_ip, dest_port | rename dest_port as line_labelindex=firewall action=allowed | stats count by src_ip, dest_ip | eval line_color=if(count>10,"red","green"index=firewall action=allowed | stats count by src_ip, dest_ip | eval remove="192.168.1.1Layout styles allow you to change the format of the graph. Not every format is useful for every data type. Test with all of the layouts. Some are also faster than others (Grid is the fastest)
- FCose (Default)
- Grid
- Circle
- Klay
- Dagre
- Concentric
- Breadthfirst
- Spread
- Cose
This app allows you to build paths between nodes. The path algorithm is customisable to give you different outcomes.
- Dijikstra (Default)
- aStar
- floydWarshall
- bellmanFord
When performing path highlighting, you can honor the direction of the path by selecting true. So in the following scenario if you wanted to map a path from A through to C in the following A:B B:C setting this setting to False would allow the path to be created.
- True
- False (Default)
If you click and hold on a node, a context relevant menu will pop-up with the following options.
- Hlt All Paths (Highlight All Paths)
This option allows you to highlight all paths from the node recursively honoring the direction set in the format menu. It will add a highlighted class to the nodes selected
- Single Path Select
This option allows you to draw a single path using the Algorithm in the format menu and honoring the direction set. To use this option, press and hold on the starting node and select Single Path Select then click and hold the target node and select Single Path Select. If a path can be found the nodes will be highlighted.
- Condense
The condense option will condense the immediate children around the selected node in a concentric layout
- Focus
Same as condense. But with a reset button.
If you click and hold in blank space on the node, a context relevant menu will pop-up with the following options.
- Menu
Brings up an additional menu with the following options
- Clear Formatting - Removes the highlighted class from all nodes
- Delete Highlighted Items - Remove all highlighted items
- Delete Non Highlighted Items - Remove all non highlighted items
- Refresh - Refreshes the layout, useful when you have removed nodes and want the layout to be recomputed.
- Save State - Allows you to save the state of the graph. Please read save state below.
- Search Edges - Allows you to enter a single term and a color to modify the style of the edge with that value
- Search Nodes - Allows you to find a node on the graph and zoom into the node.
An option exists in the framework to allow you to save the state of the graph. This becomes really useful when you want to share your view with another analyst. Before doing this you need to have the following.
- HTTP Event Collector Configured with an index of cyto
- A valid certificate for your HTTP Event Collector
- CORS Configured to allow requests
This call is performed via javascript so requires something similar to the following setup.
https://answers.splunk.com/answers/766107/how-do-i-send-data-to-http-event-collector-via-jav.html
Please report any bugs to github, Splunk Answers or alternatively hit me up on twitter @MickeyPerre
Post any feature requests as issues and I will look around to them. My only feedback prior to making feature requests is ensuring that the feature does not reduce the flexibility of the app :).
Mac
Fixed bug that prevented two link analysis visualisations from being seen on one page. Added a feature to set a token on a dashboard from what was clicked. Probably something else that I cant remember :)
Fixed truncation issues with Save State json output
Updated Search Edges to 'Style Edges' to reflect the true meaning
Fixed the historical link analysis view to ensure that the lookup and change of menu items updated the visualisation.
Updated released for .conf
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.