Reporting

Using Pivot command directly in inline search

sibbsnb
Path Finder

Is it a recommended approach to directly use the Pivot command in inline searches?

Or Pivot command should only be generated by the Pivot?

Tags (1)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

You can use it yourself in a search. It has to be first in the search pipeline, and you need a data model. See the Search Reference for information about the required inputs and for some simple examples.

View solution in original post

ChrisG
Splunk Employee
Splunk Employee

You can use it yourself in a search. It has to be first in the search pipeline, and you need a data model. See the Search Reference for information about the required inputs and for some simple examples.

sibbsnb
Path Finder

Splunk recommends not to use Pivot command directly in search

0 Karma

Claw
Splunk Employee
Splunk Employee

I would not say that is a recommendation. There are many situations where this is a perfect way to accelerate a search. It is just that the search syntax starts with the declarations for the pivot table and that is something new to learn.

0 Karma

sibbsnb
Path Finder

Thanks. I will revert back to the normal search or tsstas queries instead of Pivot statments

0 Karma

ChrisG
Splunk Employee
Splunk Employee

I see. I guess I would say you're better off using the Pivot Builder UI unless there is something specific that you're trying to achieve and the command will do for you but the UI won't. That's the best general guidance I can give you.

0 Karma

sibbsnb
Path Finder

i know we can do that, my question is "Is it recommended" to do it?

Since pivot command works well inside Pivot, it is not very readable when we use directly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...