Getting Data In
Highlighted

Pivot table filter flexibility?

Splunk Employee
Splunk Employee

I have indexed a dataset that contains a collection of customer names, their purchases, their addresses, and other various bits of information that you might expect to see in a CRM database for a web store. I've also created a data model, a variety of objects within that data model, and I've assigned "auto-extracted" attributes to each of those objects. (This feature is awesome, BTW!)

When I create a pivot, I've discovered that I can't figure out how to filter the pivot on more than one value of a particular attribute. For example, I'd like to be able to filter my pivot down to customers that reside in North Dakota, Hawaii, and Washington DC. Is it possible to create a pivot filter (without creating eval fields or using other GUI acrobatics outside the pivot interface itself) that will filter results for multiple values of a field (e.g. ND, HI, and/or DC)? When I configure multiple filters, they appear to be logically ANDed together. The result is that no entries are returned. What I'm looking for is the ability to logically OR those filters together.

Thanks!

Tags (2)
0 Karma
Highlighted

Re: Pivot table filter flexibility?

Splunk Employee
Splunk Employee

Have you tried setting up an object that uses a constraint search to ensure that it only includes events where customer = ND OR HI OR DC? As long as the customer field exists as an auto-extracted attribute in the data this should be doable. Then you could just build a pivot based on that object.

View solution in original post

Highlighted

Re: Pivot table filter flexibility?

Splunk Employee
Splunk Employee

Yes, I could do that, but that would only work for that one permutation of customer locations. It doesn't scale to any degree, unless I'm misinterpreting your response.

0 Karma
Highlighted

Re: Pivot table filter flexibility?

Splunk Employee
Splunk Employee

Unfortunately Pivot is currently limited by an inability to set up OR operations with its filters. I'll update the Pivot docs to make this clear.

Highlighted

Re: Pivot table filter flexibility?

Builder

Argh! Please fix this!

Highlighted

Re: Pivot table filter flexibility?

Path Finder

You sir. Get an upbeat! PLEASE FIX THIS!!

0 Karma
Highlighted

Re: Pivot table filter flexibility?

Path Finder

@ mattness: Where in the documentation did you add that?
I'm searching how to use filters with OR, for being able to use checkboxes to drive my dashboard panel (pivot searches)

0 Karma
Highlighted

Re: Pivot table filter flexibility?

Splunk Employee
Splunk Employee

I documented it at the note in the "Configure a filter element" subtopic: http://docs.splunk.com/Documentation/Splunk/latest/Pivot/UsingthePivotvisualizationeditor#Configure_...

0 Karma
Highlighted

Re: Pivot table filter flexibility?

Communicator

Would have liked to use this also.
This is to implement a dashboard with :
- search built with underlying pivot search
- input forms

being able for the user to give several values as filter like he would do if he was using the search bar (many choices, the user can type)

Will try to work around by adding a subfilter afterwards but that's less efficient and transparent.

0 Karma
Highlighted

Re: Pivot table filter flexibility?

New Member

I know this thread is old but since I just had the same question I wanted to post my work around. Basically I added the filter on the base search. I know it may not be practical for all users but it worked for my use case.

0 Karma