Use Pivot visualizations in Splunk Light

The Pivot tool lets you report on a specific data set without the Splunk Search Processing Language (SPL™). First, identify a dataset that you want to report on, and then use a drag-and-drop interface to design and generate pivots that present different aspects of that data in the form of tables, charts, and other visualizations.

How does Pivot work? It uses data models to define the broad category of event data that you're working with, and then uses hierarchically arranged collections of data model datasets to further subdivide the original dataset and define the fields that you want Pivot to return results on. Data models and their datasets are designed by the knowledge managers in your organization. They do a lot of hard work for you to enable you to quickly focus on a specific subset of event data.

For example, you can have a data model that tracks email server information, with datasets representing emails sent and emails received. If you want to focus on patterns in your sent email, select the "Email Activity" data model and choose the "Emails Sent" dataset.

For an in-depth conceptual overview of data models and data model datasets, see About data models in Splunk Light in this manual.

Creating a pivot:

There are two ways to navigate to the Pivots view:

• Through the Datasets page
• Through the Data Model listing page

Prerequisites

• Learn about creating a pivot in Introduction to Pivot in the Splunk Enterprise Pivot Manual.

Steps

From	What to do
Datasets page	In the menu bar, open the Datasets listing page. Identify the data model dataset for which you want to create a Pivot for. Select Pivot Click Save As... to save your changes as a report or a dashboard panel.
Knowledge > Data Models	In the sidebar menu, select Knowledge > Data models. On the Data Models page, choose a data model to identify the dataset that you want to work with. (If there's only one data model in your system you'll be moved directly to the next step, where you select an dataset in that data model.) On the Datasets page, select a dataset within that data model. Click Pivot. Click Save As... to save your changes as a report or a dashboard panel.

If you view Pivot in smaller browser windows, the navigation bar is hidden. To use the navigation bar, click the menu icon on the upper right. The navigation bar slides down.

After you select an dataset, Splunk Web takes you to the Pivot Editor where you can create a pivot using the fields that are available to you. Your pivot can take the form of a table or chart. Go to the Design pivots with the Pivot Editor topic in the Splunk Enterprise Pivot Manual to learn how to use the Pivot Editor to create a table, chart, or other visualization with Pivot.

To learn more about Pivot, see the Splunk Enterprise Pivot Manual.