What is a pivot?

As we stated earlier in this chapter, data models drive (Splunk) pivots. So what is a pivot? A pivot is created by using the Splunk Pivot Editor and can be a simple (or complex) table, chart, or dashboard. You use the Pivot Editor to map fields of data that you have defined in a data model to a specific data visualization without having to deal with the Splunk Enterprise Search Processing Language.

The Splunk pivot is a simple drag-and-drop interface that uses your (predefined) data models and data model objects. These data models (designed by the knowledge managers in your organization using the method that we outlined in the previous sections) are used by the pivot tool to define and subdivide, and to set attributes for the event data that you are interested in.

In earlier versions of Splunk, one could begin the creation of a Pivot from the home page and selecting Pivot. In version 7.0, it's a bit different.

You can create a Splunk pivot table by following these steps:

1. Go to the Splunk Home page and click on Settings; then select Data Models.
2. Next, select a data model to pivot (we'll use the previously created Aviation Games):
   

3. Once you select your data model, the Datasets Editor page will open, where you can select Pivot:
   
4. Next, from the Select a Dataset page, you can indicate a specific dataset (identifying which dataset to work with):
   
5. Once you select a dataset, you can select from the list of objects (which can be an event, transaction, search, or child type of object, and represent a specific view or slice of a Splunk search result) within that dataset to work with (or click on Edit Datasets to edit or add to the objects within the data model):

1. After you select a specific object, Splunk will take you to the Pivot Editor, where you can create your pivot: