All Apps and Add-ons

data model support

sumitnagal
Path Finder

We have created data model and using them, recently found this. wondering if i can incorporate this as part of data model ?

0 Karma

sumitnagal
Path Finder

no success, see error

Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name earliest=-2h@h was not found in object Exception". See splunkd.log for more details.
in other case it just overlay on existing graph.

0 Karma

mattness
Splunk Employee
Splunk Employee

I'm pretty sure you could incorporate the timewrap command into a data model. The real question is: Can Pivot interpret the resulting dataset in a manner that returns overlaid charts? I do not think that Pivot is currently set up to correctly process the results of this command. (But you can give it a try, I could be wrong.)

In addition it appears that within a data model, timewrap will only work with root search objects (which are based on search strings that include transforming commands like timechart or stats). Root search objects cannot take advantage of persistent data model acceleration, so if you're working with very large datasets this might not be the best solution for you, unless you don't mind waiting awhile for the resulting Pivot reports to complete.

mattness
Splunk Employee
Splunk Employee

Yeah, Pivot currently is not set up to handle chart overlay, especially when it involves two separate time ranges. For now you'll have to stick with traditional Splunk Search to generate this kind of chart.

sumitnagal
Path Finder

no success, see error

Error in 'PivotProcessor': In handler 'datamodelreport': Unexpected error "" from python handler: "Pivot Error in validateField: Field name earliest=-2h@h was not found in object Exception". See splunkd.log for more details.
in other case it just overlay on existing graph.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...