
Use Pivot visualizations in Splunk Light
The Pivot tool lets you report on a specific data set without the Splunk Search Processing Language (SPL™). First, identify a dataset that you want to report on, and then use a drag-and-drop interface to design and generate pivots that present different aspects of that data in the form of tables, charts, and other visualizations.
How does Pivot work? It uses data models to define the broad category of event data that you're working with, and then uses hierarchically arranged collections of data model datasets to further subdivide the original dataset and define the fields that you want Pivot to return results on. Data models and their datasets are designed by the knowledge managers in your organization. They do a lot of hard work for you to enable you to quickly focus on a specific subset of event data.
For example, you can have a data model that tracks email server information, with datasets representing emails sent and emails received. If you want to focus on patterns in your sent email, select the "Email Activity" data model and choose the "Emails Sent" dataset.
For an in-depth conceptual overview of data models and data model datasets, see About data models in Splunk Light in this manual.
Creating a pivot:
There are two ways to navigate to the Pivots view:
- Through the Datasets page
- Through the Data Model listing page
Prerequisites
- Learn about creating a pivot in Introduction to Pivot in the Splunk Enterprise Pivot Manual.
Steps
From | What to do |
---|---|
Datasets page |
|
Knowledge > Data Models |
|
If you view Pivot in smaller browser windows, the navigation bar is hidden. To use the navigation bar, click the menu icon on the upper right. The navigation bar slides down.
After you select an dataset, Splunk Web takes you to the Pivot Editor where you can create a pivot using the fields that are available to you. Your pivot can take the form of a table or chart. Go to the Design pivots with the Pivot Editor topic in the Splunk Enterprise Pivot Manual to learn how to use the Pivot Editor to create a table, chart, or other visualization with Pivot.
To learn more about Pivot, see the Splunk Enterprise Pivot Manual.
PREVIOUS Design data models in Splunk Light |
This documentation applies to the following versions of Splunk® Light (Legacy): 6.6.0, 6.6.1, 6.6.2, 6.6.3, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6
Feedback submitted, thanks!