This topic describes how to configure a sankey diagram to display query results.
Background information
The sankey diagram is a specific type of flow chart. It shows the flow from one set
of values to another set of values. Sankey diagrams are applicable to scenarios such
as network traffic flows. A sankey diagram contains values of three fields: source
, target
, and value
. The source
and target
fields describe the source and target nodes, and the value
field describes the flows from the source
node to the target
node.
Each sankey diagram consists of the following elements:
- Node
- Edge
The sankey diagram has the following features:
- The start flow is equal to the end flow. The overall width of all main edges is equal to the total sum of all branch edges. This allows you to manage and maintain a balanced flow of all traffic.
- The edge width in a row represents the traffic distribution in a specific status. The edge width in a row represents the distribution of traffic.
- The width of an edge between two nodes represents the flow volume in a status.
The following table lists the data that can be displayed in a sankey diagram.
source | target | value |
---|---|---|
node1 | node2 | 14 |
node1 | node3 | 12 |
node3 | node4 | 5 |
… | .. | … |
The following figure shows the data relationships in a sankey diagram.

Procedure
Example of a simple sankey diagram
If a log entry contains the
source
, target
, and value
fields, you can execute a Nested subquery statement to obtain the total sum of all steamValue
values.
* | select sourceValue, targetValue, sum(streamValue) as streamValue from (select sourceValue, targetValue,
streamValue, __time__ from log group by sourceValue, targetValue, streamValue, __time__ order by __time__ desc) group by sourceValue,
targetValue

Example of a sankey diagram for layer-7 access logs of Server Load Balance (SLB)
Log Service allows you to display query results of Usage notes in a sankey diagram.
* | select COALESCE(client_ip, slbid, host) as source, COALESCE(host, slbid, client_ip)
as dest, sum(request_length) as inflow group by grouping sets( (client_ip, slbid),
(slbid, host))
