Publish Splunk-Connected Dashboards in Tableau Server

Tableau Server is a visual analytics platform transforming the way businesses use data to solve problems. When paired with the CData JDBC Driver for Splunk, you get access to live Splunk data within Tableau Server. This article shows how to connect to Splunk in Tableau Desktop, publish a Data Source to Tableau Server, and build a simple chart from that data.

The CData JDBC Driver enables high-speed access to live Splunk data in Tableau Server. Once you install the driver, you simply authenticate with Splunk and you can immediately start building responsive, dynamic visualizations and dashboards. By surfacing Splunk data using native Tableau data types and handling complex filters, aggregations, & other operations automatically, CData JDBC Driver grants seamless access to Splunk data.

Enable Connectivity to Splunk in Tableau Server

Start by installing the CData JDBC Driver on the machine hosting Tableau Server.

If your server is a Linux Machine:

1. Copy cdata.jdbc.splunk.jar and cdata.tableau.splunk.lic.
2. Place the copies in the Tableau Server Connectors folder (/opt/tableau/tableau_driver/jdbc).
3. Restart Tableau Server.

If your server is a Windows Machine:

1. Copy cdata.jdbc.splunk.jar and cdata.tableau.splunk.lic.
2. Place the copy in the Tableau Server drivers directory (C:\ Program Files\Tableau\Drivers).
3. Restart Tableau Server.

Next, install the CData JDBC Driver on the machine running Tableau Desktop. Before starting Tableau on Windows, make sure that you have placed the .jar file in the C:\Program Files\Tableau\Drivers folder. Before starting Tableau on macOS, make sure that you have placed the .jar file in the ~/Library/Tableau/Drivers folder.

Connect to Splunk in Tableau Desktop

Once the driver is installed on the Server machine, we can configure a connection to Splunk in Tableau Desktop and publish a Splunk-based Data Source to Tableau Server.

1. Open Tableau Desktop.
2. Click More under Connect -> To a Server.
3. Select "Other Databases (JDBC)".
4. Configure the connection to the data. The driver comes with a connection string builder that streamlines creating and managing the content of connection strings. Note that you will need to manually add "jdbc:splunk" to the beginning of the connection string.
5. Click "Sign In".

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Discover Schemas and Query Data

Once you establish the connection to Splunk data, you can configure which entities to visualize.

1. Select CData from the Database pull-down menu.
2. Select Splunk from the Schema pull-down menu.
3. Drag the tables and views you wish to visualize onto the join area. You can include multiple tables.
4. Select Update Now or Automatically Update. Update Now lets you preview the first 10,000 rows of the data source (or enter the number of rows you want to see in the Rows text box). Automatically Update auto-loads the changes in the preview area.

Publish Data to Tableau Server

After you configure the data you wish to visualize, you can publish the Data Source to a Tableau Server instance. In Tableau Desktop:

1. Click Server -> Sign In.
2. Enter the URL for your Tableau Server.
3. Authenticate with Tableau Server credentials.
4. Click Server -> Publish Data Source and select your data source.
5. Click Publish.
6. Select the Project, name the Data Source, and optionally add a description.
7. Click Publish.

This creates a new entry under the server's data source list, from which you an change the data source's permissions, view its history, and perform other management tasks.

Note that workstation connected to the same server will be able to use the same source in Tableau Desktop, even if the driver isn't installed there. Also, workbooks created directly on Tableau Server (via the web interface) can use this source.

Visualize Splunk Data in Tableau Server

With the Data Source published to Tableau Server, you are ready to visualize Splunk data.

1. Login to your Tableau Server instance.
2. Connect to the remote source using the Search for Data -> Tableau Server in the Connect sidebar.
3. Click the published Data Source.
4. Click New Workbook.
5. In the workbook, Splunk fields are listed as Dimensions and Measures, depending on the data type. The CData JDBC Driver discovers data types automatically, allowing you to leverage the powerful data processing and visualization features of Tableau.
6. Drag a field from the Dimensions or Measures area to Rows or Columns. Tableau creates column or row headers.
7. Select one of the chart types from the Show Me tab. Tableau displays the chart type that you selected.

Using the CData JDBC Driver for Splunk with Tableau Server, you can easily create robust visualizations and reports on Splunk data. Download a free, 30-day trial and get started today.