Splunk® Light (Legacy)

Getting Started Manual

Acrobat logo Download manual as PDF

On October 22, 2021, Splunk Light will reach its end of life. After this date, Splunk will no longer maintain or develop this product.
Acrobat logo Download topic as PDF

Use Pivot visualizations in Splunk Light

The Pivot tool lets you report on a specific data set without the Splunk Search Processing Language (SPL™). First, identify a dataset that you want to report on, and then use a drag-and-drop interface to design and generate pivots that present different aspects of that data in the form of tables, charts, and other visualizations.

How does Pivot work? It uses data models to define the broad category of event data that you're working with, and then uses hierarchically arranged collections of data model datasets to further subdivide the original dataset and define the fields that you want Pivot to return results on. Data models and their datasets are designed by the knowledge managers in your organization. They do a lot of hard work for you to enable you to quickly focus on a specific subset of event data.

For example, you can have a data model that tracks email server information, with datasets representing emails sent and emails received. If you want to focus on patterns in your sent email, select the "Email Activity" data model and choose the "Emails Sent" dataset.

For an in-depth conceptual overview of data models and data model datasets, see About data models in Splunk Light in this manual.

Creating a pivot:

There are two ways to navigate to the Pivots view:

  • Through the Datasets page
  • Through the Data Model listing page



From What to do
Datasets page
  1. In the menu bar, open the Datasets listing page.
  2. Identify the data model dataset for which you want to create a Pivot for.
  3. Select Pivot
  4. Click Save As... to save your changes as a report or a dashboard panel.
Knowledge > Data Models
  1. In the sidebar menu, select Knowledge > Data models.
  2. On the Data Models page, choose a data model to identify the dataset that you want to work with. (If there's only one data model in your system you'll be moved directly to the next step, where you select an dataset in that data model.)
  3. On the Datasets page, select a dataset within that data model.
  4. Click Pivot.
  5. Click Save As... to save your changes as a report or a dashboard panel.

If you view Pivot in smaller browser windows, the navigation bar is hidden. To use the navigation bar, click the menu icon on the upper right. The navigation bar slides down.

After you select an dataset, Splunk Web takes you to the Pivot Editor where you can create a pivot using the fields that are available to you. Your pivot can take the form of a table or chart. Go to the Design pivots with the Pivot Editor topic in the Splunk Enterprise Pivot Manual to learn how to use the Pivot Editor to create a table, chart, or other visualization with Pivot.

To learn more about Pivot, see the Splunk Enterprise Pivot Manual.

Last modified on 20 May, 2019
Design data models in Splunk Light

This documentation applies to the following versions of Splunk® Light (Legacy): 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters