Link graphs

Learn how link graphs display relationships between data values using nodes, rows, columns, and visual links that you can rearrange with the fieldOrder option.

Use link graphs to visualize the relationship between data values. Similar to a table, link graphs have rows and columns.

Each row contains nodes that represent a value or values. If there are multiple rows of the same value, the values group together in a single node.

The visual links connecting rows and columns represent the relationship between data values. Links only show between adjacent columns in the visualization. You can rearrange the columns by adding the source option fieldOrder to the source code.

Generate a link graph

Configure and customize link graph visualizations in Splunk dashboards, including data sources, display options, colors, node sizing, spacing, and interaction behaviors.

  1. Select the Add chart button ( The Add Chart button in the editing toolbar. ) in the editing toolbar and browse through the available charts. Choose the link graph.
  2. Set up a new data source by selecting + Create search, + Create saved search, or + Create chain search and adding a search or select an existing data source under the Search, Saved search, or Chain search sections.
  3. Select Apply and close.

Configuration panel options

You can use the Configuration panel to configure the following link graph components.

Title

Give your visualization a name. This is also helpful when searching for individual visualizations in the dashboard definitions. This name is not the same as the automatically assigned unique ID.

Description

Give your visualization a description to explain what the user is viewing.

Data sources

You can choose one of the following data options:

  • An existing data source or create a new data source
  • A chain search
  • A saved search
Visibility

Position and size

In absolute layout, you can use your mouse to change the size of the panel, or the Position and size section of the Configuration panel for pixel perfect sizing and placement.

Data configurations

  • Result limit: specify the number of nodes rendered in each column.

Data display

  • Show node counts: toggle on to display the number of nodes for each column. If there are hidden nodes, the total number of nodes also displays.
  • Show value counts: toggle on to display a count for the frequency of occurrence for each distinct node value.

Color and style

  • Title color: configure a font color for the visualization title.

  • Description color: configure a font color for the visualization description.

  • Nodes: specify the color used for unhighlighted nodes.

  • Selected nodes: specify the color used for highlighted nodes.

  • Links: specify the color used for links between nodes. Non-highlighted links display at 20% opacity.

  • Background color: specify the color used for the background. The default for enterprise light is hexadecimal "#FFFFFF". The default for enterprise dark is hexadecimal "#000000".

  • Text wrapping: specify how to truncate the text within a column:

    • Anywhere: start a new line when text reaches column width, breaking words into the next line when necessary.

    • Break-word: start a new line when text reaches column width, moving words into the next line instead of breaking them.

    • Ellipsis: truncate the text to fit in the column with an ellipsis.

  • Adjust the sizing of nodes and space with the following:

    • Node width
    • Minimum node height
    • Vertical spacing
    • Horizontal spacing
    • Link width

Interactions

Select + Add interaction to set up different visualization interactions such as linking to a custom URL, setting tokens, or linking to a report. For more details, see Add dashboard interactions.

Source code

Select your visualization or its search to view and edit the source code in real-time. You can also change the Visualization ID to a more readable ID to help identify this visualization in the source code.

Link graph example

See an example of configuring a link graph visualization by defining its data source and reviewing the required table structure.

The following example shows a dashboard with a link graph titled "Access Paths from User Groups to Data Stores", which provides data for how different user groups connect to data stores through access methods, web servers, and applications. Each path represents an access flow, ending in an allowed or blocked outcome, which helps illustrate relationships, shared infrastructure, and unusual access patterns across systems. The dashboard also includes a table which shows the same data as the link graph for reference.

A dashboard with a link graph showing user group access paths to data stores. The dashboard also includes a table which shows the same data as the link graph for reference.

Copy and paste the dashboard definition into your own dashboard to see the example:

PYTHON 
{
    "title": "Link graph example",
    "description": "",
    "inputs": {
        "input_global_trp": {
            "options": {
                "defaultValue": "-24h@h,now",
                "token": "global_time"
            },
            "title": "Global Time Range",
            "type": "input.timerange"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            },
            "ds.spl2": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        },
        "visualizations": {
            "global": {
                "showProgressBar": true
            }
        }
    },
    "visualizations": {
        "viz_CpuQHWWV": {
            "dataSources": {
                "primary": "ds_lTa2hbtz"
            },
            "options": {},
            "type": "splunk.table"
        },
        "viz_pFYmFc9X": {
            "dataSources": {
                "primary": "ds_lTa2hbtz"
            },
            "options": {
                "linkColor": "#4fa484",
                "linkWidth": 3,
                "nodeColor": "#f8be34"
            },
            "title": "Access Paths from User Groups to Data Stores",
            "type": "splunk.linkgraph"
        }
    },
    "dataSources": {
        "ds_lTa2hbtz": {
            "name": "Search_1",
            "options": {
                "query": "| makeresults count=15\n| streamstats count AS row\n| eval \"User group\"=case(row<=4,\"Finance users\", row<=7,\"Support users\", row<=10,\"Engineering users\", row<=12,\"Contractors\", true(),\"Unknown users\")\n| eval \"Access method\"=case(row<=4,\"VPN\", row<=7,\"SSO\", row<=9,\"SSO\", row=10,\"SSH bastion\", row<=12,\"Partner portal\", true(),\"Public internet\")\n| eval \"Web server\"=case(row=1 OR row=2,\"web-01\", row=3 OR row=4 OR row=15,\"web-02\", row=5 OR row=6,\"web-03\", row=7,\"web-04\", row=8 OR row=9,\"web-05\", row=10,\"web-06\", row=11 OR row=12,\"web-07\", true(),\"web-08\")\n| eval Application=case(row<=3 OR row=15,\"Orders API\", row=4,\"Billing API\", row<=6,\"Customer Portal\", row=7,\"Knowledge Base\", row<=9,\"Build Service\", row=10,\"Deploy Service\", row<=12,\"Case Management\", true(),\"Admin Console\")\n| eval \"Data store\"=case(row<=3 OR row=15,\"orders-db\", row=4,\"billing-db\", row<=6 OR row<=12,\"crm-db\", row=7,\"kb-db\", row<=9,\"artifact-store\", row=10,\"config-db\", true(),\"admin-db\")\n| eval Outcome=case(row<=12,\"Allowed\", true(),\"Blocked\")\n| table \"User group\" \"Access method\" \"Web server\" Application \"Data store\" Outcome\n"
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_global_trp"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_pFYmFc9X",
                        "position": {
                            "h": 400,
                            "w": 1270,
                            "x": 10,
                            "y": 10
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_CpuQHWWV",
                        "position": {
                            "h": 320,
                            "w": 1270,
                            "x": 10,
                            "y": 420
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "options": {},
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

Source options for link graphs

Configure and manage data source options that control how link graphs display relationships and interactions in your visualizations.

The following options are available for editing link graphs in the source editor:

Property Type Default Description
backgroundColor string

> themes. defaultBackgroundColor

 Specify the color for the background. You may use a dataSource to apply the color. The default for enterprise light is "#ffffff". The default for enterprise dark is "#000000". The default for prisma dark is "#0b0c0e".
fieldOrder string

> primary | getField()

 Specify the order of fields to be displayed in the link graph from left to right when loaded. Unspecified fields will be excluded from the graph.
linkColor string #6d6f76 Specify the color used for highlighted links. Unhighlighted links will be displayed at 20% opacity.
linkWidth number 1 Specify, in pixels, the stroke width of each link.
nodeColor string

> themes. defaultNodeColor

 Specify the color used for unhighlighted nodes.
nodeTextColor string

> nodeColor | maxContrast (nodeTextColorMaxContrast)

 Specify the color used for unhighlighted nodes text.
nodeHeight number 21 Specify, in pixels, the height of each node.
nodeHighlightColor string #7B56DB Specify the color used for highlighted nodes.
nodeLabelOverflow string ellipsis

Specify how to truncate the text within a column:

  • anywhere: start a new line when text reaches node width, breaking words into the next line when necessary.

  • break-word: start a new line when text reaches node width, moving words into the next line instead of breaking them.

  • ellipsis: truncate the text to fit in the node with an ellipsis.
nodeTextHighlightColor string

> nodeHighlightColor | maxContrast (nodeHighlightTextColorMaxContrast)

 Specify the color used for highlighted nodes text.
nodeSpacingX number 32 Specify, in pixels, the horizontal spacing between each node.
nodeSpacingY number 18 Specify, in pixels, the vertical spacing between each node.
nodeWidth number 180 Specify, in pixels, the width of each node.
resultLimit number 50 Specify the number of nodes rendered in each column.
showNodeCounts boolean TRUE Specify whether a count is shown for the number of nodes displayed in each column. The number of total nodes is also shown if there are hidden nodes.
showValueCounts boolean TRUE Specify whether a count is shown for the frequency of occurrence for each distinct node value.