sankey() Query Function

A companion function Sankey Widget that produces data compatible with the widget.

Parameters

Name

Type

Required

Default

Description

source

string

Yes

The field containing the source node ID.

target

string

Yes

The field containing the target node ID.

weight

Aggregate

No

count(as=_count)

A function used to calculate the weight the edges. Good candidates are functions like e.g. sum, count or max.

The implied parameter is sankey.

Examples

For a webserver log, show which URLs match HTTP methods

humio
#type=accesslog | sankey(source=method, target=url)

For a webserver log, show referrers by URL

humio
#type=accesslog referrer!="-"| sankey(source=referrer, target=url)