Splunk Search

How to use a data model to create a timechart plotting the count of events with a dynamic drilldown to a table?

snemiro_514
Path Finder

Hi splunkers,

I started reading about data models, but I think I'm not getting the concept.

In my case, I have events describing transactions.

In my Data Model, I've defined an root object called "Transactions", with the proper source. Then, I've defined several child objects, "Success", "Error-Invalid data", "Error-DB connection" and "Error-Timeout" using contraints.

Now, I would like to create a timechart and plot the count of those events, and a dynamic drilldown to a table, so when you click on any "Success" in the timechart, it shows the "Success" events in the table.

So my question is, how can this be achieved?

I'm doing something similar with a search, but because we keep adding codes and redefining some transaction types, I would like to separate the taxonomy from the dashboard. I had to rewrite 11 new conditions because a new ErrorCode=E077 was now considered part of "Error - Invalid Data"....and I would like to use the data model instead.

Thanks!

0 Karma
1 Solution

snemiro_514
Path Finder

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.

View solution in original post

snemiro_514
Path Finder

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...