How to Use Sankey Graphs

Sankey graphs are useful because they turn complex flows into something immediately understandable. They help analysts and operators see where traffic or events come from, where they go, and how large the flows are. This is especially effective for visualizing communication paths, data movement, and traffic distribution.

Prefer watching?

Check the related video walkthrough:

Why Sankey Graphs Are Practical

In IT environments, Sankey graphs can illustrate website traffic, network traffic, flows between external IPs and internal systems, or communication between countries and interfaces. The thickness of each line represents volume, allowing major flows and unusual imbalances to stand out immediately.

1. Start from an existing panel

Open an empty dashboard, click Add, and search for the predefined Data Flow visualization. This is the easiest way to start because the panel already contains the required structure.

2. Clone and customize

Clone the graph first so the original stays untouched. Then open the editor. On the left side, you will see the graph configuration, and on the right side the rendered result. In most cases, you only need to change the field names that define the left and right side of the flow.

3. Update field mapping

For example, if the current graph shows traffic from IP addresses to interfaces, you can replace one of those fields with another relevant attribute. Make sure the graph also points to the correct index or data source. Click update and verify the result.