Implementing Splunk 7, Third Edition - Third Edition

Data Models and Pivots

In Splunk version 7.0, Splunk has implemented various key optimizations in its core search technology in an effort to reduce the time and resources required to run data model accelerations and accelerated searches. To this end, we have added a section on this topic.

In this chapter, we will introduce the following:

• Data models
• Pivots (along with pivot elements and filters)
• Sparklines

Also in Splunk, data models and pivots should be discussed together because data models drive (Splunk) pivots. So, let's start by defining data models.