As we stated earlier in this chapter, data models drive (Splunk) pivots. So what is a pivot? A pivot is created by using the Splunk Pivot Editor and can be a simple (or complex) table, chart, or dashboard. You use the pivot editor to map fields of data that you have defined in a data model to a specific data visualization without having to deal with the Splunk Enterprise Search Processing Language.
The Splunk pivot is a simple drag and drop interface that uses your (predefined) data models and data model objects. These data models (designed by the knowledge managers in your organization using the method that we outlined in the previous sections) are used by the pivot tool to define and subdivide, and to set attributes for the event data that you are interested in.
You can create a Splunk pivot table by following these steps:
Go to the Splunk Home page and click Pivot for the app workspace that you want to use (I chose Search & Reporting):
Then click on Pivot:
Next, from the...