Splunk Operational Intelligence Cookbook

Summary

The key takeaways from this chapter are as follows:

• Data models allow Splunk datasets and associated knowledge to be mapped for use by the Pivot tool
• Data models contain objects of different types, constraints, and attributes
• Data models can be accelerated to speed up Pivot searching over the underlying dataset mapped by the model
• Data models power the Pivot tool and allow dynamic reports and visualizations to be built without the need to write any searches
• The Pivot tool allows for simple point and click, drag-and-drop, and slicing and dicing of modeled data
• Pivot is suitable for less technical users, but leveraging the Splunk SPL directly is more powerful and advanced