Splunk® Enterprise

Data Model and Pivot Tutorial

Download manual as PDF

Download topic as PDF

Create a pivot chart

In the previous topic you used Pivot visualization editor to build a table. In this topic, you will use the same dataset to create chart visualizations.

Define a new Pivot

  1. From the Splunk bar, select Settings > Data models.
  2. Select the Buttercup Games data model.
  3. In the Datasets editor page, click Pivot.
  4. In the Select a Dataset page, select the Successful Purchases child dataset.

    The New Pivot editor for Successful Purchases opens.

    7.0 dmtutorial successful purchases pivot.png

Add Pivot elements

For the pivot chart, let's report on the count of successful purchases by category. To do this, you will add a Split Row using the categoryId field.

  1. Under Split Rows, click + and select categoryId from the list.
    6.2tutorial pivot splitrow chart.png

  2. For Label type Category and click Add to table.
    6.2tutorial pivot splitrow chart2.png
    This returns the following Pivot table. 6.5Pivot Tutorial SplitRowChart.png

Change the visualization type

  1. Click the Column Chart icon from the visualization bar.
    6.5Tutorial Pivot Column Visualization.png
    The New Pivot editor for the Column chart displays.
    • Column charts use the first split row element in pivot table definitions to provide their X-axis values. In this case, that Split Row is Category.
    • Column charts use the first column value element in pivot table definitions to provide their Y-axis values. Here, that Column Value is Count of Successful Purchases.
    6.5Tutorial Pivot Pie Visualization.png

  2. This data can also be visualized as a pie chart.

  3. Click the Pie Chart icon from the visualization bar:
    The New Pivot editor for the Pie chart displays.
    • Pie charts use the values from the first Split Row element (Category) to determine the number and colors of their slices.
    • Pie charts use the first Column Value element (Count of Successful Purchases) to determine the relative sizes of their slices.
    6.5Pivot Tutorial Pie Visualization.png
    Mouseover a slice of the pie chart to view the metrics: Category, Count of Successful Purchases, and percentage of the total Count of Successful Purchases.

Next steps

In this chapter you created three pivots and saved two of them as reports. This last pivot chart, you will save as a dashboard panel. Continue to the next chapter to read about dashboards.

PREVIOUS
Create a pivot table
  NEXT
About dashboards

This documentation applies to the following versions of Splunk® Enterprise: 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10


Comments

Hi Gregbo,

Thanks for catching this! I've gone ahead and fixed it.

Myu splunk, Splunker
January 31, 2017

Under Step 2, it says "The New Pivot editor for the Column chart displays." ... Should it be "The New Pivot editor for the *Pie* chart displays."?

Gregbo
January 31, 2017

Hi Jeff,

Field names in Splunk are case sensitive. Make sure that you are looking for "categoryId" if that is the field name you are extracting.

Myu splunk, Splunker
November 15, 2016

When adding a Split Row for categoryid, I get the "You search returned no results" error. However, there are 5224 events. Other fields like productid work and populate the search. I am not sure if I have done something wrong along the way of the tutorial, or if the tutorial is out of date and not working as it was originally created.

Jeffbennett splunk, Splunker
November 15, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters