Create a Dataset from Splunk

This article details how to create a Dataset populated with data sourced from Splunk.

For general instructions on building a Dataset, see Create a Dataset from any Data Source.

PREREQUISITE:

1. Access New > Dataset > Create New

  1. Measured: select the measurement interval that applies to your element
  2. Collecting: is disabled by default and is enabled once you enable the Dataset
  3. Category: specify the Category where your Dataset will be placed
  4. Move to the Data tab  

2. Define the Settings for Data Collection

  1. Data Source: select the connection profile you have created for Splunk
  2. Data collection trigger: specify the Trigger to fetch data for the Dataset
  3. Search: select a Splunk object to serve as a basis of your Dataset
  4. Plugin command: [Select Columns] from the Visual tab, or enter an MIQL plugin command directly from the Command tab
  5. Validate your query

[6.3.1] Datasets can be moved between the available Data Storages. The screen below shows Tableau, but the functionality is essentially the same for all Plugins.

Click the Edit icon next to the Data Storage on Data tab and follow the prompts to complete the operation.

3. Enable & View Dataset

  1. If the command is validated successfully, the Dataset columns and Validation Rows Preview will be shown below
  2. At the upper right corner of the screen, click [Enable & View] to enable the Dataset to display the complete set of fetched records

4. Dataset Viewer

Dataset Viewer is displayed upon Enabling:

  1. Default View is All data.  Any changes made will not affect the All data View, but may be saved as a New View
  2. For more information on using Filters, refer to Create a Dataset View
  3. Access Actions > Build Metrics to build Metrics directly from the Dataset Viewer.