Create a Dataset from Splunk

This article details how to create a Dataset populated with data sourced from Splunk.

For general instructions on building a Dataset, see Create a Dataset from any Data Source.

PREREQUISITE:

1. Access New > Dataset > Create New

Zoom:
  1. Measured: select the measurement interval that applies to your element
  2. Collecting: is disabled by default and is enabled once you enable the Dataset
  3. Category: specify the Category where your Dataset will be placed
  4. Move to the Data tab  

2. Define the Settings for Data Collection

Zoom:
  1. Data Source: select the connection profile you have created for Splunk
  2. Data collection trigger: specify the Trigger to fetch data for the Dataset
  3. Search: select a Splunk object to serve as a basis of your Dataset
  4. Plugin command: [Select Columns] from the Visual tab, or enter an MIQL plugin command directly from the Command tab
  5. Validate your query

3. Enable & View Dataset

Zoom:
  1. If the command is validated successfully, the Dataset columns and Validation Rows Preview will be shown below
  2. At the upper right corner of the screen, click [Enable & View] to enable the Dataset to display the complete set of fetched records

4. Dataset Viewer

Zoom:

Dataset Viewer is displayed upon Enabling:

  1. Default View is All data.  Any changes made will not affect the All data View, but may be saved as a New View
  2. For more information on using Filters, refer to Create a Dataset View
  3. Access Actions > Build Metrics to build Metrics directly from the Dataset Viewer.