Splunk® Enterprise

Data Model and Pivot Tutorial

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

About Pivot

The Splunk Pivot tool lets you quickly design reports with tables and data visualizations that present different aspects of a selected Data Model. Pivot lets you generate these reports with a UI interface instead of having to use the search processing language.

Accessing Pivot from the Datasets page

In Part 2, you built a data model and created a root dataset called Purchase Requests and added two child datasets, one for successful purchases and one for failed purchases.

  1. From the Buttercup Games dataset editor page, click Pivot.
  2. 7.0 dmtutorial access pivot.png

  3. Select the Purchase Requests dataset. This is the dataset that you want use to create the pivot.
    The New Pivot page appears and shows information using the Purchase Requests dataset.
  4. If your browser window is not full screen, the Apps bar is hidden. You can access the Apps bar by click the menu icon in the upper right corner of the window. The Apps bar slides down. Click the menu icon again to hide the Apps bar.

The New Pivot editor

The following image shows the New Pivot editor page. The key components of the editor page are highlighted.

7.0 dmtutorial pivot editor.png

The components of the New Pivot editor page that are identified in the image are described in the following table.

Number Element Description
1 Visualization types A list of icons that represent different visualization types.
2 Filters You can specify time range and field filters for your pivot.
3 Pivot actions Use the Pivot actions to:
  • Save the pivot as a report or dashboard panel.
  • Clear, or remove, the changes that you made in the Pivot editor. This enables you to experiment with the different visualizations before you save the pivot.
  • Edit the current dataset.
  • Other data model dataaset actions, such as view the data model for the current dataset, select a different dataset, and acceleration actions.
4 Job actions Pivot job actions are similar to search job actions. You can pause or stop the progress of the pivot job, share or export the pivot job, and open the pivot in the Search app.
5 Apps bar Navigate between the different views in the application you are in. For the Search & Reporting app the views are: Search, Datasets, Reports, Alerts, and Dashboards.

Visualization types

The left-hand vertical bar contains icons that represent different visualization types. Selecting a different icon controls which Pivot builder and report interfaces display. Visualization types are: Statistics Table (default), Column Chart, Bar Chart, Scatter Chart, Bubble Chart, Area Chart, Line Chart, Pie Chart, Single Value Display, Radial Gauge, Marker Gauge, and Filler Gauge.

Pivot actions

The upper horizontal bar displays document-related actions. These actions include:

  • Save as...: Save the current report as a new one (Report) or as a dashboard panel (Dashboard Panel).
  • Clear: Reset the interface to its initial state, which will dismiss the saved report (if applicable), change the visualization type to Statistics Table, and populate the report with a single Column Value for the count of the dataset and a time filter for all time (if _time is an applicable field).
  • Data model dataset: This is the right-most button. It takes its label from the data model dataset that was selected. For example, in the screenshot it is "Purchase Requests". Use this menu to navigate back to the list of data models (Select another Data Model), navigate back to the list of data model datasets (Select another Dataset), or edit the selected data model dataset (Edit Dataset). Additionally, you can rebuild acceleration and inspect the acceleration job.

Pivot datasetsselector.png


Job actions

The Pause and Stop buttons control the progress of the Pivot job. Other actions include: Share, Export, Print, and Open in Search. Clicking Open in Search opens the Search view and runs the current search string.

Learn more

The topic briefly described what you need to know to access the pivot interface and build Pivots in the rest of this chapter. Read the Pivot Manual for more information.

Next steps

Continue to the next topic, where you will use Pivot to build a report from the Buttercup Games data models you created in a previous chapter.

Last modified on 16 February, 2018
PREVIOUS
Define child datasets
  NEXT
Create and save a pivot report

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters