topic Re: Using Pivot command directly in inline search in Reporting

Using Pivot command directly in inline search

sibbsnb — Wed, 04 Jun 2014 20:14:10 GMT

Is it a recommended approach to directly use the Pivot command in inline searches?

Or Pivot command should only be generated by the Pivot?

Re: Using Pivot command directly in inline search

ChrisG — Wed, 04 Jun 2014 20:27:06 GMT

You can use it yourself in a search. It has to be first in the search pipeline, and you need a data model. See the Search Reference for information about the required inputs and for some simple examples.

Re: Using Pivot command directly in inline search

sibbsnb — Wed, 04 Jun 2014 21:32:28 GMT

i know we can do that, my question is "Is it recommended" to do it?

Since pivot command works well inside Pivot, it is not very readable when we use directly.

Re: Using Pivot command directly in inline search

ChrisG — Wed, 04 Jun 2014 21:54:50 GMT

I see. I guess I would say you're better off using the Pivot Builder UI unless there is something specific that you're trying to achieve and the command will do for you but the UI won't. That's the best general guidance I can give you.

Re: Using Pivot command directly in inline search

sibbsnb — Wed, 04 Jun 2014 22:28:56 GMT

Thanks. I will revert back to the normal search or tsstas queries instead of Pivot statments

Re: Using Pivot command directly in inline search

sibbsnb — Wed, 20 Aug 2014 18:50:36 GMT

Splunk recommends not to use Pivot command directly in search

Re: Using Pivot command directly in inline search

Claw — Wed, 07 Sep 2016 16:24:25 GMT

I would not say that is a recommendation. There are many situations where this is a perfect way to accelerate a search. It is just that the search syntax starts with the declarations for the pivot table and that is something new to learn.