Reporting

Can I use Pivot to show daily indexed data from Sample data model?

melonman
Motivator

Hi
I am playing with Splunk 6, and trying to learn Pivot.
Now I am seeing a few data model for internal logs, but is there any useful case of pivot for those data model?
It seems very user friendly, but I am not just familiar with the data model of internal logs.

I would really appreciate if anyone could give me a sample of pivot use for internal logs or data models.

Thank you in advance..

Tags (2)
0 Karma
1 Solution

davebrooking
Contributor

From my limited knowledge, the following produces quantity indexed over time by sourcetype

  1. Using the Quota Usage object from the Splunk’s Internal Server Logs – Sample Data model

  2. For the Split Rows select _time and the appropriate size bucket you want from the Period picker

  3. For the Split Columns select Sourcetype

  4. In Column Values select GB indexed, and for Value select Sum

Dave

View solution in original post

0 Karma

davebrooking
Contributor

From my limited knowledge, the following produces quantity indexed over time by sourcetype

  1. Using the Quota Usage object from the Splunk’s Internal Server Logs – Sample Data model

  2. For the Split Rows select _time and the appropriate size bucket you want from the Period picker

  3. For the Split Columns select Sourcetype

  4. In Column Values select GB indexed, and for Value select Sum

Dave

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.