As we stated earlier in this chapter, data models drive (Splunk) pivots. So what is a pivot? A pivot is created by using the Splunk Pivot Editor and can be a simple (or complex) table, chart, or dashboard. You use the Pivot Editor to map fields of data that you have defined in a data model to a specific data visualization without having to deal with the Splunk Enterprise Search Processing Language.
The Splunk pivot is a simple drag-and-drop interface that uses your (predefined) data models and data model objects. These data models (designed by the knowledge managers in your organization using the method that we outlined in the previous sections) are used by the pivot tool to define and subdivide, and to set attributes for the event data that you are interested in.
In earlier versions of Splunk, one could begin the creation of a Pivot from the home page and selecting Pivot. In version 7.0, it's a bit different.
You can create a Splunk pivot table by following these steps:
- Go...