...
Table of Contents | ||
---|---|---|
|
Overview
The Sankey diagram is a very flexible type of chart that allows you to:
Compare two fields from the same table according to an aggregate value.
Compare information correlating two or more tables that are linked by a common field.
What data do I need for this widget?
In order to generate the cross-search sankey diagram using an aggregate value, you need to run a single query with at least three columns, one of them numerical. Furthermore, that query needs to have the data grouped for the diagram to show meaningful data.
In order to generate the cross-search sankey diagram using correlation, you need to run at least two queries with at least three columns, one of them numerical and one of them in common. Furthermore, those queries need to have the data grouped for the diagram to show meaningful data.
Create a cross-search Sankey diagram using a single table
Rw ui steps macro | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Go to Data Search, open a query and perform the necessary operations.
Click the gear icon on the toolbar and select Graphical Correlation → Cross-search sankey diagram.
Here is the set of variables the diagram needs to be constructed. The Source node, the Link weight and the Target node. The source will be placed to the left side of the diagram, the source to the right and the links will establish the connection between them based on the values.
Click and drag the columns from the table and drop them onto the corresponding variables.
The Sankey diagram appears. The source and the target nodes are connected by the link values.
If you click the stats switch, the legend explaining the links contained in the diagram will be hidden.
Clicking the inner join switch will not show any actual change because it is designed for diagrams constructed with two different queries to correlate data. We will see this information later in this article.
In case you want to know the values that segments represent, hover over each of them to activate a tooltip with the information.
To modify the columns used to create the chart, click the settings button at the top right corner of the table window .
You can download your cross-search table join as a CSV file by clicking the Export data as CSV button at the top right corner of the table window . |
Create a cross-search Sankey diagram using several tables
Rw ui steps macro | |||||||
---|---|---|---|---|---|---|---|
Go to Data Search, open at least two queries and perform the necessary operations.
Click the gear icon on the toolbar and select Graphical Correlation → Cross-search graph diagram.
Click the window symbol next to the unknown table name to add the variables for a second table. Be aware that after the first column is added, the unknown name will become the name of the table that contains the column.
Here is the set of variables the diagram needs to be constructed. The Target node of the first table is linked to the Source node of the following. This is designed to add the columns that are shared by both tables so Devo can use them as the central variable to merge the two tables. They need to have the same name or have the same data type and structure, otherwise they will not be accepted.
The new table appears. The rows from different tables whose data can be correlated through a common column are merged together. |
Anchor | ||||
---|---|---|---|---|
|
If you click the stats switch, the legend explaining the links contained in the diagram will be hidden.
Clicking the inner join switch will split the merged variables and show their data separately instead of correlated.
In case you want to know the values that segments represent, hover over each of them to activate a tooltip with the information.
To modify the columns used to create the chart, click the settings button at the top right corner of the table window .
You can download your cross-search table join as a CSV file by clicking the Export data as CSV button at the top right corner of the table window .
Query example
You can use the following queries to recreate the examples shown in the images above:
Sankey diagram using an aggregate value:
Code Block from siem.logtrust.web.navigation group every 5m by userEmail, srcPort, action, city every 5m select count() as count
Sankey diagram using the correlation between two tables:
Code Block from siem.logtrust.web.navigation group every 5m by userEmail, action, srcPort, city every 5m select count() as count
Code Block from siem.logtrust.web.activity group every 5m by srcPort, username, responseTime, city every 5m