The 2D shapes (whether they are circle, rectangle, etc) occupy too much space on the screen and yet important pieces of associated information such as name, IP address, device identity, URL, email, etc - don’t fit inside them. This method, however, comes with an inherent problem of organizing them into layouts that not only have to be easy to understand but also have to be easy to interact and pivot on. It’s popular, and almost standard practice, to represent each data element in some sort of geometrical 2D shapes. Thismakes it difficult, if not impossible, to understand and analyze. The problem with these layouts is that after trying to squeeze more than 100-200 data points and all the connections between them - the view is like that of a spider web. To illustrate this problem - here is an example of poor implementation of link analysis: The challenge with any interactive data investigation techniques and visualizations is that the amount of data to be analyzed is growing exponentially yet the amount of screen real estate space remains constant. Link Analysis frequently used in the space of cybersecurity, fraud analytics, crime investigations, finance and in other areas where it is essential to discover hidden anomalies, unusual connections, suspicious relationships and otherwise insights that are important for business.

This is a very visual and interactive technique that can be done in the Splunk platform – and is almost always driven by a person, an analyst or investigator, to understand the data and discover necessary insights specific to the business problem at hand. Link Analysis is a data analysis approach used to discover relationships and connections between data elements and entities.

Link analyze