gephi-splunk-project | Updates to Gephi code | Plugin library

You should now have all you need on the Gephi side to replicate the two screenshots above. #Altering Data Sources To change the URLs on the server to request data from, go into ClickMenuPlugin/src/main/java/org/gephi/plugins/example/tool and open up AddNodesTool.java. The variable for the URL is called NODE_URL. You will then have to open up terminal and run “mvn clean package” from the ClickMenuPlugin directory (install apache maven if you don’t have it)-. Your .nbm file in “Target” should now be updated. The data for the second screenshot is populated from the SplunkGephi plugin. This plugin imports the respective .gexf file located in /gephi-0.9.1/modules/application. You can also choose to import data directly from Splunk by making a call to the server. If you wish to use other datasets (other than IP addresses, usernames, session IDs, and user agents), then you will need to modify some of the code within AddNodesTool.java of the ClickMenuPlugin and TextManager.java of Gephi sourcecode (file provided in "ModifiedClasses" directory). Specifically, the AddNodesTool class implements the node drilldown, collapse, and expand logic, and the TextManager class dictates what icon will be used based on the gephi data column, "nodetype". #Expanding on the basic demos To be more clear on what format Gephi expects, I will break down the two possibilities. The first is starting from a blank workspace. In this case, the Splunk search will fully populate the workspace with data, which requires the data to be much more robust. This project formats the results for this kind of use case into a .gexf (https://gephi.org/gexf/format/). Gephi recognizes this format and automatically populates the workspace with whatever is in that file. The other possibility is to enrich data in an existing workspace by bringing in additional nodes and edges. This is done in this project through actions, which involve clicking on a node, passing that data through the server pipeline and Splunk, and returning a list of nodes that are connected to the selected node Gephi, which visualizes that new data by building edges between the selected node and the newly added nodes. In order to expand on these demos, you are probably interested in running your own searches and visualizing those. Unfortunately, this will require a bit of work on your end to ensure everything is formatted correctly, however the existing code should provide a good starting point to mimic and get your own searches into Splunk. I will describe where you will need to make changes for expansions to the basic demos.
Now, within the Gephi application that you just started, click on the toolbar: Tools > Plugins > Downloaded > Add Plugins…
Go into gephi-splunk-project/ClickMenuPlugin/target directory (cloned from git)
Select click-menu-plugin-1.0.0.nbm.
Do the same for gephi-splunk-project/SplunkGephi (cloned from git), which has a file called splunk-gephi-1.0.0.nbm.
Click install for these two plugins, follow prompts, which in turn will prompt a restart of Gephi, click Restart Now.
Mac: Pip Download get-pip.py from https://bootstrap.pypa.io/get-pip.py In the directory you downloaded get-pip.py to run: python get-pip.py Splunklib: Run: sudo pip install splunk-sdk Flask: Run: sudo pip install Flask Requests: Run: sudo pip install requests
Windows: Pip Download get-pip.py from https://bootstrap.pypa.io/get-pip.py In the directory you downloaded get-pip.py to run: python get-pip.py Splunklib: Run: pip install splunk-sdk Flask: Run: pip install Flask Requests: Run: pip install requests
To set up the local Gephi-Splunk Server, open a terminal and move into the directory containing the gephi_gss folder. Then move into gephi_gss/app. Run: "flask init.py" and the local server should start up.
To set up the script server, open a terminal and move into the directory containing the script_server folder. Then move into script_server/app. Run "flask init.py" and the local server should start up.
You can visit http://127.0.0.1:5000/ and http://127.0.0.1:4999/ in your browser to see a (rough) front end and some administration functionality. Default username/password for the GSS and the script server is "admin"/"secret".
If you have already set up Gephi, you should at this point be able to run through the demos. Note the first demo is just using locally stored data on the GSS, because the Splunk searches we are running will not work on your Splunk instance without importing the whole data set we used. To set up this project to use live Splunk searches in the second demo, you will first need to import data into your Splunk instance, then tweak some server code to point to the location of your instance. This will be discussed further below.
First you will need to import the sample.csv data set that we are using for our visualizations into a local Splunk instance you have access to.
Make sure to name the sourcetype of this data "sample" by clicking on "Save as" and changing the name from csv to "sample".
Now you need to make sure the scripts that will interact with Splunk are pointing to the right instance (default is localhost:8000) and have the right credentials.
Shut down the script_server using Control-C
Open the file script_server/app/templates/ipinf.py and change the lines with a #CHANGEME comment to match your Splunk instance credentials.
Restart the script server by going into the script_server/app directory
Run "flask init.py" and the local server should start up. You should now be able to run the second demo, which will be enriching data in Gephi by using a live Splunk search.
To create the first screenshot, open up “sixIPs.gexf” with Gephi, which was cloned from git. Then, with your server started (see server setup), click on the “Get – Actions” tool, which looks like a circle with a white plus sign. Make sure the “Direct Selection” tool is selected as well, and click on a node to populate the menu with actions. Click “Drilldown All”, which should make a call to the server to populate nodes on the graph. Then apply “Force Atlas” layout for a few seconds and then “Noverlap”.
To create the second screenshot, click from the toolbar “Plugins” and select a dataset. Then apply Fruchterman Reingold, Force Atlas, and Noverlap layouts. Warning, the Noverlap layout can crash the application if certain things are clicked afterwards. Apply a trivial, non-transforming layout right after Noverlap to avoid this crash.
To access icons, click on the “Show Node Labels” button on the bottom
Follow instructions here for windows: https://www.mkyong.com/maven/how-to-install-maven-in-windows/
Install homebrew for macs: http://brew.sh/, then type in the command “brew install maven” into terminal
To update the plugin within the Gephi application, you will need to start the Gephi application via netbeans as you did before.
Then go into Tools>Plugins>Installed
Select the checkbox next to "Click Menu Plugin"
Click the "Uninstall" button, and go through the prompts to restart the application
Once the application restarts, install the plugin as you did above, and your changes should be made
To change which file is imported, alter the file path in HeadlessSimple.java (from gephi-splunk-project/SplunkGephi/src/main/java/org/gephi/plugins/example/submenu).
To do this, set your headers and URL in Splunk.java, and call the method from TestAction.java. Then follow the same instructions as were provided to alter "Click Menu Plugin, using “mvn clean package” and reinstalling the plugin.