Splunk Search

How to use a data model to create a timechart plotting the count of events with a dynamic drilldown to a table?

snemiro_514
Path Finder

Hi splunkers,

I started reading about data models, but I think I'm not getting the concept.

In my case, I have events describing transactions.

In my Data Model, I've defined an root object called "Transactions", with the proper source. Then, I've defined several child objects, "Success", "Error-Invalid data", "Error-DB connection" and "Error-Timeout" using contraints.

Now, I would like to create a timechart and plot the count of those events, and a dynamic drilldown to a table, so when you click on any "Success" in the timechart, it shows the "Success" events in the table.

So my question is, how can this be achieved?

I'm doing something similar with a search, but because we keep adding codes and redefining some transaction types, I would like to separate the taxonomy from the dashboard. I had to rewrite 11 new conditions because a new ErrorCode=E077 was now considered part of "Error - Invalid Data"....and I would like to use the data model instead.

Thanks!

0 Karma
1 Solution

snemiro_514
Path Finder

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.

View solution in original post

snemiro_514
Path Finder

It was very simple.... I've decided to create an Eval field in the data model, and then timechart that value.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...