Splunk Search

How to use a data model to create a timechart plotting the count of events with a dynamic drilldown to a table?

snemiro_514
Path Finder

Hi splunkers,

I started reading about data models, but I think I'm not getting the concept.

In my case, I have events describing transactions.

In my Data Model, I've defined an root object called "Transactions", with the proper source. Then, I've defined several child objects, "Success", "Error-Invalid data", "Error-DB connection" and "Error-Timeout" using contraints.

Now, I would like to create a timechart and plot the count of those events, and a dynamic drilldown to a table, so when you click on any "Success" in the timechart, it shows the "Success" events in the table.

So my question is, how can this be achieved?

I'm doing something similar with a search, but because we keep adding codes and redefining some transaction types, I would like to separate the taxonomy from the dashboard. I had to rewrite 11 new conditions because a new ErrorCode=E077 was now considered part of "Error - Invalid Data"....and I would like to use the data model instead.

Thanks!

0 Karma
1 Solution

snemiro_514
Path Finder

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.

View solution in original post

snemiro_514
Path Finder

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...