com.splunk

Class PivotSpecification

java.lang.Object

com.splunk.PivotSpecification

public class PivotSpecification
extends Object

PivotSpecification represents a pivot to be done on a particular data model object. The user creates a PivotSpecification on some data model object, adds filters, row splits, column splits, and cell values, then calls the pivot method to query splunkd and get a set of SPL queries corresponding to this specification.

Method Summary

Modifier and Type	Method and Description
PivotSpecification	addCellValue(String field, String label, StatsFunction statsFunction) Add an aggregate to each cell of the pivot.
PivotSpecification	addColumnSplit(String field) Add a column split on a string or number valued field, producing a column for each distinct value of the field.
PivotSpecification	addColumnSplit(String field, Integer start, Integer end, Integer step, Integer limit) Add a column split on a numeric field, splitting the values into ranges.
PivotSpecification	addColumnSplit(String field, String trueDisplayValue, String falseDisplayValue) Add a column split on a boolean valued field.
PivotSpecification	addColumnSplit(String field, TimestampBinning binning) Add a column split on a timestamp valued field.
PivotSpecification	addFilter(String field, BooleanComparison comparison, boolean compareTo) Add a filter on a boolean valued field.
PivotSpecification	addFilter(String field, IPv4Comparison comparison, String comparisonValue) Add a filter on an IPv4 valued field.
PivotSpecification	addFilter(String field, NumberComparison comparison, double comparisonValue) Add a filter on a numeric field.
PivotSpecification	addFilter(String field, StringComparison comparison, String comparisonValue) Add a filter on a string valued field.
PivotSpecification	addFilter(String field, String sortAttribute, SortDirection sortDirection, int limit, StatsFunction statsFunction) Add a filter that limits the number of values of an aggregated field that will be allowed into the pivot.
PivotSpecification	addRowSplit(String field, String label) Add a row split on a numeric or string valued field, splitting on each distinct value of the field.
PivotSpecification	addRowSplit(String field, String label, Integer start, Integer end, Integer step, Integer limit) Add a row split on a numeric field, splitting into numeric ranges.
PivotSpecification	addRowSplit(String field, String label, String trueDisplayValue, String falseDisplayValue) Add a row split on a boolean valued field.
PivotSpecification	addRowSplit(String field, String label, TimestampBinning binning) Add a row split on a timestamp valued field, binned by the specified bucket size.
String	getAccelerationNamespace()
Collection<PivotCellValue>	getCellValues()
Collection<PivotColumnSplit>	getColumnSplits()
Collection<PivotFilter>	getFilters()
Collection<PivotRowSplit>	getRowSplits()
Pivot	pivot() Query Splunk for SPL queries corresponding to this pivot.
PivotSpecification	setAccelerationJob(Job job) Set a job with a query ending in tscollect, usually generated by createLocalAccelerationJob on a DataModelObject instance, as the acceleration cache for this pivot.
PivotSpecification	setAccelerationJob(String sid) Set a job with a query ending in tscollect, usually generated by createLocalAccelerationJob on a DataModelObject instance, as the acceleration cache for this pivot.
PivotSpecification	setAccelerationNamespace(String namespace) Set the namespace to use for this acceleration, usually the name of a data model.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

setAccelerationNamespace

public PivotSpecification setAccelerationNamespace(String namespace)

Set the namespace to use for this acceleration, usually the name of a data model. A value of null will set no namespace for acceleration.

Parameters:

namespace - a string specifying a namespace.

Returns:

PivotSpecification instance

setAccelerationJob

public PivotSpecification setAccelerationJob(String sid)

Set a job with a query ending in tscollect, usually generated by createLocalAccelerationJob on a DataModelObject instance, as the acceleration cache for this pivot.

Parameters:

sid - the SID of a job.

Returns:

PivotSpecification instance

setAccelerationJob

public PivotSpecification setAccelerationJob(Job job)

Set a job with a query ending in tscollect, usually generated by createLocalAccelerationJob on a DataModelObject instance, as the acceleration cache for this pivot.

Parameters:

job - a Job object.

Returns:

PivotSpecification instance

getAccelerationNamespace

public String getAccelerationNamespace()

Returns:

the acceleration namespace to use in this pivot.

addFilter

public PivotSpecification addFilter(String field,
                                    BooleanComparison comparison,
                                    boolean compareTo)

Add a filter on a boolean valued field. The filter will be a constraint of the form field `comparison` compareTo for example is_remote = false

Parameters:

field - the name of the field

comparison - a comparison operator for the filter

compareTo - the value to compare the field to

Returns:

the PivotSpecification you are operating on.

addFilter

public PivotSpecification addFilter(String field,
                                    StringComparison comparison,
                                    String comparisonValue)

Add a filter on a string valued field. The filter will be a constraint of the form field `comparison` compareTo for example host startswith 'boris'

Parameters:

field - the name of the field

comparison - a comparison operator for the filter

comparisonValue - the value to compare the field to

Returns:

the PivotSpecification you are operating on.

addFilter

public PivotSpecification addFilter(String field,
                                    IPv4Comparison comparison,
                                    String comparisonValue)

Add a filter on an IPv4 valued field. The filter will be a constraint of the form field `comparison` compareTo for example hostip = 192.168.100.12

Parameters:

field - the name of the field

comparison - a comparison operator for the filter

comparisonValue - the value to compare the field to

Returns:

the PivotSpecification you are operating on.

addFilter

public PivotSpecification addFilter(String field,
                                    NumberComparison comparison,
                                    double comparisonValue)

Add a filter on a numeric field. The filter will be a constraint of the form field `comparison` compareTo for example height > 6

Parameters:

field - the name of the field

comparison - a comparison operator for the filter

comparisonValue - the value to compare the field to

Returns:

the PivotSpecification you are operating on.

addFilter

public PivotSpecification addFilter(String field,
                                    String sortAttribute,
                                    SortDirection sortDirection,
                                    int limit,
                                    StatsFunction statsFunction)

Add a filter that limits the number of values of an aggregated field that will be allowed into the pivot.

Parameters:

field - the name of a field

sortAttribute - field to aggregate for limiting

sortDirection - whether to take the lowest or highest values of the aggregated field

limit - how many values of the aggregated field to take

statsFunction - the function to use for aggregation

Returns:

The PivotSpecification you are modifying.

addRowSplit

public PivotSpecification addRowSplit(String field,
                                      String label)

Add a row split on a numeric or string valued field, splitting on each distinct value of the field.

Parameters:

field - name of the field to split on

label - a human readable name for this set of rows

Returns:

The PivotSpecification you are modifying.

addRowSplit

public PivotSpecification addRowSplit(String field,
                                      String label,
                                      Integer start,
                                      Integer end,
                                      Integer step,
                                      Integer limit)

Add a row split on a numeric field, splitting into numeric ranges. This split generates bins with edges equivalent to the classic loop 'for i in <start> to <end> by <step>' but with a maximum number of bins <limit> . This dispatches to the stats and xyseries search commands. See their documentation for more details.

Parameters:

field - The field to split on

label - a human readable name for this set of rows

start - the value of the start of the first range, or null to take the lowest value in the events.

end - the value for the end of the last range, or null to take the highest value in the events.

step - the width of each range, or null to have Splunk calculate it.

limit - the maximum number of ranges to split into, or null for no limit.

Returns:

The PivotSpecification you are modifying.

addRowSplit

public PivotSpecification addRowSplit(String field,
                                      String label,
                                      String trueDisplayValue,
                                      String falseDisplayValue)

Add a row split on a boolean valued field.

Parameters:

field - String value

label - String value

trueDisplayValue - the string to display in the true valued row label.

falseDisplayValue - the string to display in the false valued row label;

Returns:

The PivotSpecification you are modifying.

addRowSplit

public PivotSpecification addRowSplit(String field,
                                      String label,
                                      TimestampBinning binning)

Add a row split on a timestamp valued field, binned by the specified bucket size.

Parameters:

field - the name of the field to split on.

label - a human readable name for this set of rows

binning - the size of bins to use

Returns:

The PivotSpecification you are modifying.

addColumnSplit

public PivotSpecification addColumnSplit(String field)

Add a column split on a string or number valued field, producing a column for each distinct value of the field.

Parameters:

field - the field to split on.

Returns:

The PivotSpecification you are modifying.

addColumnSplit

public PivotSpecification addColumnSplit(String field,
                                         Integer start,
                                         Integer end,
                                         Integer step,
                                         Integer limit)

Add a column split on a numeric field, splitting the values into ranges.

Parameters:

field - the field to split on.

start - the value of the start of the first range, or null to take the lowest value in the events.

end - the value for the end of the last range, or null to take the highest value in the events.

step - the width of each range, or null to have Splunk calculate it.

limit - the maximum number of ranges to split into, or null for no limit.

Returns:

The PivotSpecification you are modifying.

addColumnSplit

public PivotSpecification addColumnSplit(String field,
                                         String trueDisplayValue,
                                         String falseDisplayValue)

Add a column split on a boolean valued field.

Parameters:

field - the field to split on.

trueDisplayValue - the string to display in the true valued column label.

falseDisplayValue - the string to display in the false valued column label.

Returns:

the PivotSpecification you are working on.

addColumnSplit

public PivotSpecification addColumnSplit(String field,
                                         TimestampBinning binning)

Add a column split on a timestamp valued field.

Parameters:

field - the field to split on.

binning - what time periods to use for binning valued of the field.

Returns:

the PivotSpecification you are working on.

addCellValue

public PivotSpecification addCellValue(String field,
                                       String label,
                                       StatsFunction statsFunction)

Add an aggregate to each cell of the pivot.

Parameters:

field - the field to aggregate.

label - a human readable name for this aggregate.

statsFunction - the function to use for aggregation.

Returns:

the PivotSpecification you are working on.

getFilters

public Collection<PivotFilter> getFilters()

Returns:

a collection of all the filters added to this PivotSpecification.

getRowSplits

public Collection<PivotRowSplit> getRowSplits()

Returns:

a collection of all the row splits added to this PivotSpecification.

getColumnSplits

public Collection<PivotColumnSplit> getColumnSplits()

Returns:

a collection of all the column splits added to this PivotSpecification.

getCellValues

public Collection<PivotCellValue> getCellValues()

Returns:

a collection of all the cell values added to this PivotSpecification.

pivot

public Pivot pivot()

Query Splunk for SPL queries corresponding to this pivot.

Returns:

a Pivot object encapsulating the returned queries.