Data Models and Pivot

In larger organizations, not every user wants to or should have to write a Splunk search to get analytical values. Many users will want to create their owns reports and analyses in an ad hoc fashion, but will reject tools that force them to write what they perceive as code.

Splunk data models and the Pivot tool work hand in hand to meet the needs of these types of people. These functionalities enable more casual end users to generate statistical data and charts without needing to know Search Processing Language (SPL).

A data model is a hierarchical mapping of data based on search results. The output of the data model's underlying search queries can be visualized as a set of rows and columns in a spreadsheet, using the Pivot tool.

The Pivot tool is what is used to present data fields as rows and columns of data. Using the Pivot tool, a user can create...

Creating a data model

To create a data model of our existing Eventgen data, perform the following steps:

1. In the Destinations app, click on the Settings menu. Under the Knowledge Objects section, select Data Models. This page will be empty until you have created your first data model.
2. Click on the New Data Model button in the upper-right corner of the screen to proceed.

3. In the Data Models screen, click on New Data Model.
4. Give your new data model a Title and ID, and ensure that it is created in the Destinations app. Refer to the following screenshot as a guide:
   

5. Click on Create. You are now in the Destinations data model editing page.
6. Click on the Add Dataset dropdown and select Root Event. The concept of data model hierarchy is now in play. The Root Event or Root Search is the base search that will populate the data for the entire data model tree.
7. Populate the Root Event...

Data model acceleration

When you enable acceleration for a data model, Splunk internally pre-summarizes the data defined by the data model for a given time range. This gives a tremendous boost to the search speed for your data model when searches are executed within the given time range. There are a couple of things to remember when you enable data model acceleration:

1. Once you enable acceleration for a data model, you will no longer be able to edit the data model objects. Ensure that your model and related child objects and attributes are accurate before implementing acceleration. A huge data model may take some time to complete the acceleration process, so plan accordingly. You will only be able to edit the data model again if you disable the acceleration.
2. Select your summary range wisely. The summary range is the calculation time span that the acceleration will use against...

Rearranging your dashboard

To change the arrangement of the panels on the dashboard, follow these steps:

1. In the Summary Dashboard, click on the Edit button and select Edit Panels. This will convert the panels into widgets that you can drag around using each widgets header area.
2. Change the final layout of your Summary Dashboard to look like the following screenshot. Click on Save once you have laid the widgets out in the correct orientation:

Summary Dashboard

Summary

In this chapter, we showed you how to build a three-panel dashboard without writing a single Splunk search command. Pivots can be a powerful tool to expose Splunk to business users who are data savvy, but perhaps initially resist learning to write Splunk commands to extract value from data.

To enable Pivots, we showed you how to create a data model used by the Pivot editor to create analyses, reports, and dashboards. You walked through creating your data model objects based on a hierarchy. You saw how data models can consist of attributes from existing data fields, inherited from parent objects, or extracted using a regular expression.

Finally, you used the very intuitive Pivot editor and created three different visualizations: area chart, pie chart, and single value with trend sparkline. You used those to create and organize a three-panel dashboard.

In the next Chapter...