Configurable Sunburst visualization that is easy to use. Built using D3. Tooltips, optional breadcrumbs, label customisations and numerous color schemes. Works in dark-mode. Sunburst charts are useful to display hierarchical data.
Copyright (C) 2019 Chris Younger. I am a Splunk Professional Services consultant working for JDS Australia, in Brisbane Australia.
Source code | Questions, Bugs or Suggestions | My Splunk apps
This app is not "visible" in the Splunk UI app menu. After installing the app, follow this process:
1. Do a search of any data and switch to the visualisation tab
2. In the top left, in the visualisastion menu, select "Sunburst viz"
3. Open the "Format" menu then select "Help"
4. There will be a link to the in-app documentation, which includes working examples
This visualisation expects tablular data, with any amount of text/category columns, but the last column should be the numerical value. Null or blank columns are allowed before the final column to create a more "sunburst-y" visualization.
The typical search uses stats command like so:
index=* | stats count BY index sourcetype source
Sidenote: a much faster search to do the same thing is
|tstats count where index=* BY index sourcetype source
Note that stats does not return rows when the group BY field is null. Use this one simple trick to convert nulls to be an empty string instead:
index=_internal | eval component = coalesce(component,"") | eval log_level = coalesce(log_level,"") | stats count by sourcetype component log_level
Add more fields after the "BY" keyword to increase the depth of the sunburst
The "Color overrides" field accepts either a JSON object (in curly braces) or comma separated pairs. For example to make sure that "INFO" values are green, WARN's are orange and ERROR's are red, set the value like so:
INFO,#1a9035,ERROR,#b22b32,WARN,#AF5300
The Click Action setting under Format Visualization has four settings:
* None - Nothing will happen when the sunburst is clicked
* Zoom in - The sunburst will display only two rings at a time. Clicking a ring will filter the sunburst to that slice, displaying its subcategories as the inner ring. To zoom back out, click the whitespace inside the inner ring
* Drilldown to search - Clicking the sunburst will open the underlying SPL as a search
* Set tokens ＄sunburst_viz_{field}＄ - Clicking the sunburst will set tokens with names according to the field values in your result set. Tokens will be set all the way down to the subcategory that is clicked, so if you have "| stats count by index source sourcetype", clicking a value in the source ring will set tokens $sunburst_viz_index$ and $sunburst_viz_source$, but not $sunburst_viz_sourcetype$.
The following third-party libraries are used by this app. Thank you!
no changes, just a version bump to keep splunkbase from archiving the app
Documentation improvements - Thanks to emilmottola
v1.4.6
* Fix broken viz when null data. Thank you Tatsuya-hasegawa for supplying pull request.
v1.4.5
* Update internal jquery library for Splunk Cloud compatibility
v.1.4.3
* Token handling improvements. New format menu option so you can set what the token will default to, when null.
v.1.3.2
* Minor bug fixes
v1.3.1
* Fix for 7.3 to remove "undefined" messages in format menu
v1.4.5
* Update internal jquery library for Splunk Cloud compatibility
v.1.4.3
* Token handling improvements. New format menu option so you can set what the token will default to, when null.
v.1.3.2
* Minor bug fixes
v1.3.1
* Fix for 7.3 to remove "undefined" messages in format menu
v.1.4.3
* Token handling improvements. New format menu option so you can set what the token will default to, when null.
v.1.3.2
* Minor bug fixes
v1.3.1
* Fix for 7.3 to remove "undefined" messages in format menu
v.1.3.2
* Minor bug fixes
v1.3.1
* Fix for 7.3 to remove "undefined" messages in format menu
Now works in IE11 and Edge. Handles large dataset better.
More color themes, add color overrides, different coloring modes, updated logo, better error handling
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.