Query, Visualize, and Share live Splunk Data in Redash

Redash is a collaboration tool that lets you query, visualize, and share your data. When paired with CData Connect Cloud, Redash gets access to live Splunk data. This article demonstrates how to connect to Splunk using Connect Cloud and work with live Splunk data in Redash.

CData Connect Cloud provides a pure SQL Server interface for Splunk, allowing you to query data from Splunk without replicating the data to a natively supported database. Using optimized data processing out of the box, CData Connect Cloud pushes all supported SQL operations (filters, JOINs, etc.) directly to Splunk, leveraging server-side processing to return the requested Splunk data quickly.

Configure Splunk Connectivity for Redash

Connectivity to Splunk from Redash is made possible through CData Connect Cloud. To work with Splunk data in Redash, we start by creating and configuring a Splunk connection.

1. Log into Connect Cloud, click Connections and click Add Connection
2. Select "Splunk" from the Add Connection panel
3. Enter the necessary authentication properties to connect to Splunk.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

4. Click Create & Test
5. Navigate to the Permissions tab in the Add Splunk Connection page and update the User-based permissions.

Add a Personal Access Token

If you are connecting from a service, application, platform, or framework that does not support OAuth authentication, you can create a Personal Access Token (PAT) to use for authentication. Best practices would dictate that you create a separate PAT for each service, to maintain granularity of access.

1. Click on your username at the top right of the Connect Cloud app and click User Profile.
2. On the User Profile page, scroll down to the Personal Access Tokens section and click Create PAT.
3. Give your PAT a name and click Create.
4. The personal access token is only visible at creation, so be sure to copy it and store it securely for future use.

Connect to Splunk from Redash using Connect Cloud

To establish a connection from Redash to CData Connect Cloud using the SQL Server API, follow these steps.

1. Log into Redash.
2. Click the settings widget on the top right.
3. Click New Data Source.
4. Select Microsoft SQL Server as the Data Source Type.
5. On the configuration tab, set the following properties:
   • Database Name: enter the Connection Name of the CData Connect Cloud data source you want to connect to (for example, Salesforce1).
   • Server: enter the virtual SQL Server host name (tds.cdata.com)
   • User: enter your CData Connect Cloud username. This is displayed in the top-right corner of the CData Connect Cloud interface. For example, [email protected].
   • Password: enter the PAT you generated on the Settings page.
   • Port: enter 14333
6. Click Create.
7. Click Test Connection to ensure that the connection is configured properly.

You can now work with live Splunk data in Redash.

Get CData Connect Cloud

To get live data access to 100+ SaaS, Big Data, and NoSQL sources directly from Redash, try CData Connect Cloud today!