Reporting

Splunk 6 data model restrictions based on attribute type

brettcave
Builder

I've started playing around with Splunk 6, looking at data models and pivot tables. In my data model, I have a child object that contains numeric attributes, with a root object representing a user. The child object represents repetitive events, e.g. "Profile saved" events, that might contain values like "how many times a day do you brush your teeth" and "how much do you spend on toothpaste" (for illustrative purposes).

If I configure the object with these attributes as "Numeric", and want to use the last value (to get the most recent amount that a user spends on toothpaste), I am unable to do so, because the "Values" drop-down in the Column Values section doesn't include "last" value - last, first and list are available for strings, while numeric only offers mathematical functions (sum, etc).

Is there a way to reconfigure Splunk6 to allow "last" function on numeric values (assuming that in the background, the pivot is using a stats function for this).

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

Unfortunately the contents of the "Values" drop-down is not configurable at the moment, though it's likely we will be adding more options for each data type in future releases.

In the meantime, one workaround you can try is to create a new Eval attribute that you just set equal to the original numeric attribute, but make the new attribute a string. Then in pivot you should be able do numeric operations on one and string operations on the other.

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

In what way can't you represent it numerically? Do you mean you'd like to make it the y-axis of a chart?

0 Karma

brettcave
Builder

Thanks Simon. I did try the workaround. The only problem is when you try report (graphically) on a string - you can't represent the value (numerically).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...