data model support

[sumitnagal]

We have created data model and using them, recently found this. wondering if i can incorporate this as part of data model ?

[sumitnagal]

no success, see error

Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name earliest=-2h@h was not found in object Exception". See splunkd.log for more details.
in other case it just overlay on existing graph.

[mattness]

I'm pretty sure you could incorporate the timewrap command into a data model. The real question is: Can Pivot interpret the resulting dataset in a manner that returns overlaid charts? I do not think that Pivot is currently set up to correctly process the results of this command. (But you can give it a try, I could be wrong.)

In addition it appears that within a data model, timewrap will only work with root search objects (which are based on search strings that include transforming commands like timechart or stats). Root search objects cannot take advantage of persistent data model acceleration, so if you're working with very large datasets this might not be the best solution for you, unless you don't mind waiting awhile for the resulting Pivot reports to complete.

[mattness]

Yeah, Pivot currently is not set up to handle chart overlay, especially when it involves two separate time ranges. For now you'll have to stick with traditional Splunk Search to generate this kind of chart.

[sumitnagal]

no success, see error

Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name earliest=-2h@h was not found in object Exception". See splunkd.log for more details.
in other case it just overlay on existing graph.