Reports in Splunk - Splunk Essentials - page 106

Creating a pivot table
Pivot tables allow you to view the data in many different ways. Splunk has many shortcuts
that users can take advantage of to create pivots easily. We will create a simple pivot table
here, using the following steps:
1. We want to open the pivot table interface, so we go to Home Page , and then, under
Search and Reporting , select Pivot .
2. To create a pivot table, you use a model. Data models allow you to structure the
fields in objects that are easy to pull data from. You should see a short list of mod-
els. A model is set up by someone who has detailed knowledge of the data and its
properties. Here, we will use a model that is downloaded when you download
Splunk. Click on Splunk's Internal Audit Logs—SAMPLE . After you select the
model, you will see a screen that shows the objects in the model:
Select a Data Object