Dashboards & Visualizations

D3 Visualization

rajgowd1
Communicator

Hi Experts,
can anyone please provide help on D3 integration in splunk for visualization.
i have below search and i want it to be visualized using D3.

sample output is

tcp 0 0 10.40.88.178:7171 poc-card-luna1.nad.ns:50326 ESTABLISHED
tcp 0 0 12b8-splfwd02.ndm.nsro:7171 poc-card-luna1.nad.ns:50326 TIME_WAIT
tcp 0 0 10.40.88.178:7171 poc-card-luna2.nad.ns:50326 TIME_WAIT

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
|chart values(state) by hostOrIp1 hostOrIp2

Tags (1)
0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

https://docs.splunk.com/Documentation/Splunk/6.5.0/AdvancedDev/CustomVizTutorial covers how to build a custom visualization in Splunk. The example in the link also happens to use D3 as the visualization library.

Also worth looking at Splunkbase as a few custom visualizations ( https://splunkbase.splunk.com/apps/#/app_content/visualizations ) are already up there and some of which also use D3. It might be your D3 visualization you want to use has already be done and you can use that. Or you could install them and see how they work as a point of reference.

rajgowd1
Communicator

HI,
is it possible to tune this query and show them in existing splunk visualization formats like bar,pie,line or area

index=netstat|rex field=_raw "^(?[\S]+)\s*?(?[\S]+)\s*?(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s*?(?[^:]+):(?[\S]+)\s.*?(?[\S]+)"
| eventstats count by state hostOrIp1 hostOrIp2 |eval CountConnStatus=count+" - "+state|chart values(CountConnStatus) by hostOrIp1 hostOrIp2

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

So this feels a bit like a follow up question. Would you mind accepting the answer for the D3 question (if it answers the D3 question). Then re-asking the follow up question as a new question. It should help other people who come to visit these questions at a later date. (Also a bit more detail on the follow question would be good).

So short answer, what you are asking for feels doable.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...