I am trying to create a pivot chart from static data stored in a .CSV file. The data is not time-dependent and I am using a lookup to import the data into Splunk. When I access the lookup using |inputlookup datafile.csv in the Search and Reporting App, I am able to view the data, but am given limited options when trying make visualizations out of the search. When creating a data model using this lookup, I get the message "This dataset is not pivotable".
Is there a way to make this lookup dataset pivotable? Is this not possible with lookups? Currently I'm able to create a visualization, but without the customization I'd like when using data that is added when uploaded or monitoring files.
I ran into this when clicking on the pivot button from the data model page. Once I moved out and clicked on Datasets, I was able to build my pivot.
Yea, datasets are probably a better fit. A lookup is now considered a dataset type actually. http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutdatasets#Lookups