Reporting
Highlighted

Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Path Finder

I am familiar with Pivot tables under Microsoft Excel and would like to recreate Pivot tables in Splunk, but don't know where to begin.
Splunk requires data models, but how does a data model match my input file and why does Splunk
needs it to create a Pivot Table?
I see only two sample data models under Pivot. How can I add data models? Does Pivot work like in Excel?
I would appreciate any help. Thanks!

Tags (3)
0 Karma
Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Splunk Employee
Splunk Employee

There is a short Pivot Manual that covers the basic concepts and procedures about how Pivot works in Splunk Enterprise.

I also recommend the Pivot Tutorial, which has a walkthrough with a sample data set.

View solution in original post

Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Path Finder

I have seen the pivot manual but how can you go about it if the Buttercup Games Sales data model does not exist? There are only two audit data models: Internal Audit Logs and Internal Server Logs Samples.
Thanks!

0 Karma
Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Splunk Employee
Splunk Employee

The Pivot Tutorial walks through loading the Buttercup Games sample data and creating the data model.

Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Path Finder

Is there a step by step example or video in creating just Data Model than the reference to Data Model and Pivot Tutorial? The reference seems to be written for an advance Splunk user. We need the Data Model 101 course. Thanks!

0 Karma
Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Splunk Employee
Splunk Employee

There is a Pivot video I found: https://www.youtube.com/watch?v=MdjDrDTXYWQ.

The tutorial is pretty straightforward, though: it walks you through downloading the sample data, getting it in, and creating the data model. The only extra complexity is that it includes a lookup table to enrich the data.

Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Path Finder

I am stuck on Add lookup attributes from lookup tables but the prices_lookup under Add Attributes with a Lookup is missing and only shows the dnslookup. Did I miss a step?

0 Karma
Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Splunk Employee
Splunk Employee

Did you define the pricelookup attribute in the previous step? http://docs.splunk.com/Documentation/Splunk/6.2.2/PivotTutorial/AddlookupfilestoSplunk#Addthefieldlookup_definition.

Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Path Finder

I tried but I don't know where the prices.csv resides. It is not in the tutorialdata.zip file downloaded in the first step. Ok I found finally found it. I missed a step. Thanks!

0 Karma
Highlighted

Re: Pivot 101: I see only two sample data models under Pivot. How can I add data models? Does Pivot work like Excel?

Splunk Employee
Splunk Employee