topic Re: data model support in All Apps and Add-ons

data model support

sumitnagal — Tue, 14 Jan 2014 15:41:33 GMT

We have created data model and using them, recently found this. wondering if i can incorporate this as part of data model ?

Re: data model support

mattness — Tue, 14 Jan 2014 18:44:38 GMT

I'm pretty sure you could incorporate the timewrap command into a data model. The real question is: Can Pivot interpret the resulting dataset in a manner that returns overlaid charts? I do not think that Pivot is currently set up to correctly process the results of this command. (But you can give it a try, I could be wrong.)

In addition it appears that within a data model, timewrap will only work with root search objects (which are based on search strings that include transforming commands like timechart or stats). Root search objects cannot take advantage of persistent data model acceleration, so if you're working with very large datasets this might not be the best solution for you, unless you don't mind waiting awhile for the resulting Pivot reports to complete.

Re: data model support

sumitnagal — Wed, 15 Jan 2014 07:53:20 GMT

no success, see error

Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name earliest=-2h@h was not found in object Exception". See splunkd.log for more details.
in other case it just overlay on existing graph.

Re: data model support

sumitnagal — Wed, 15 Jan 2014 07:53:40 GMT

Re: data model support

mattness — Wed, 15 Jan 2014 18:38:39 GMT

Yeah, Pivot currently is not set up to handle chart overlay, especially when it involves two separate time ranges. For now you'll have to stick with traditional Splunk Search to generate this kind of chart.