Search icon
Subscription
0
Cart icon
Close icon
You have no products in your basket yet
Save more on your purchases!
Savings automatically calculated. No voucher code required
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletters
Free Learning
Arrow right icon
Splunk Essentials - Second Edition

You're reading from  Splunk Essentials - Second Edition

Product type Book
Published in Sep 2016
Publisher
ISBN-13 9781785889462
Pages 236 pages
Edition 2nd Edition
Languages
Authors (3):
Betsy Page Sigman Betsy Page Sigman
Profile icon Betsy Page Sigman
Somesh Soni Somesh Soni
Profile icon Somesh Soni
Erickson Delgado Erickson Delgado
Profile icon Erickson Delgado
View More author details

Table of Contents (15) Chapters

Splunk Essentials Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface
1. Splunk in Action 2. Bringing in Data 3. Search Processing Language 4. Data Models and Pivot 5. Data Optimization, Reports, Alerts, and Accelerating Searches 6. Panes of Glass 7. Splunk SDK for JavaScript and D3.js 8. HTTP Event Collector 9. Best Practices and Advanced Queries

Creating a data model


Before you can create a Pivot table, you need to develop a set of rows and columns through the creation of a data model. To do this, perform the following steps:

  1. In the Destinations app, click on the Pivot link in the top menu. Observe the Select a Data Model page, which will be empty until you have created your first data model.

  2. Click on the Manage Data Models button in the upper-right corner of the screen to proceed.

  3. In the Data Models screen, click on New Data Model.

  4. Give your new data model a title and ID and ensure that it is created in the Destinations app. Refer to the following screenshot as a guide:

  5. Click on Create. You are now in the Destinations data model editing page.

  6. Click on the Add Object dropdown and select Root Event. The concept of data model hierarchy is now in play. The Root Event or Root Search is the base search that will populate the data for the entire data model tree.

  7. Populate the Root Event with the fields seen in the following screenshot. We want...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $15.99/month. Cancel anytime}