Build Splunk-Connected Visualizations in datapine

datapine is a browser-based business intelligence platform. When paired with the CData Connect Cloud, you get access to your Splunk data directly from your datapine visualizations and dashboards. This article describes connecting to Splunk in CData Connect Cloud and building a simple Splunk-connected visualization in datapine.

CData Connect Cloud provides a pure SQL Server interface for Splunk, allowing you to query data from Splunk without replicating the data to a natively supported database. Using optimized data processing out of the box, CData Connect Cloud pushes all supported SQL operations (filters, JOINs, etc.) directly to Splunk, leveraging server-side processing to return the requested Splunk data quickly.

Configure Splunk Connectivity for datapine

Connectivity to Splunk from datapine is made possible through CData Connect Cloud. To work with Splunk data from datapine, we start by creating and configuring a Splunk connection.

1. Log into Connect Cloud, click Connections and click Add Connection
2. Select "Splunk" from the Add Connection panel
3. Enter the necessary authentication properties to connect to Splunk.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

4. Click Create & Test
5. Navigate to the Permissions tab in the Add Splunk Connection page and update the User-based permissions.

Add a Personal Access Token

If you are connecting from a service, application, platform, or framework that does not support OAuth authentication, you can create a Personal Access Token (PAT) to use for authentication. Best practices would dictate that you create a separate PAT for each service, to maintain granularity of access.

1. Click on your username at the top right of the Connect Cloud app and click User Profile.
2. On the User Profile page, scroll down to the Personal Access Tokens section and click Create PAT.
3. Give your PAT a name and click Create.
4. The personal access token is only visible at creation, so be sure to copy it and store it securely for future use.

Connecting to Splunk from datapine

Once you configure your connection to Splunk in Connect Cloud, you are ready to connect to Splunk from datapine.

1. Log into datapine
2. Click Connect to navigate to the "Connect" page
3. Select MS SQL Server as the data source
4. In the Integration step, fill in the connection properties and click "Save and Proceed"
   • Set the Internal Name
   • Set Database Name to the name of the connection we just configured (e.g. Splunk1)
   • Set Host / IP to "tds.cdata.com"
   • Set Username to your Connect Cloud username (e.g. user@mydomain.com)
   • Set Password to the corresponding PAT
   • Set Database Port to "14333"
5. In the Data Schema step, select the tables and fields to visualize and click "Save and Proceed"
6. In the References step, define any relationships between your selected tables and click "Save and Proceed"
7. In the Data Transfer step, click "Go to Analyzer"

Visualize Splunk Data in datapine

After connecting to CData Connect Cloud, you are ready to visualize your Splunk data in datapine. Simply select the dimensions and measures you wish to visualize!

Having connect to Splunk from datapine, you are now able to visualize and analyze real-time Splunk data no matter where you are. To get live data access to 100+ SaaS, Big Data, and NoSQL sources directly from datapine, try CData Connect Cloud today!