Splunk Operational Intelligence Cookbook - Third Edition

How it works...

In this recipe, you explored some additional features of Splunk's Pivot tool. To pivot off data related to response time, you had to add the response time field to the underlying Web Access data model. Selecting to pivot off the All Web Access dataset filtered the dataset to the data defined within the dataset constraints - in this case, only the web access event data. When you began setting up the Pivot in step 9, you initially split the rows by uri_path and chose to sort the rows in a descending order, keeping only 10 rows. This is very similar to performing a | top uri_path search at the end of a filtered Splunk search, where only the top 10 results are displayed. When you changed Column Value to average ResponseTime, Splunk ...