Build Dashboards with Splunk Data in DBxtra

The CData ODBC Driver for Splunk enables access to live data from Splunk under the ODBC standard, allowing you work with Splunk data in a wide variety of BI, reporting, and ETL tools and directly, using familiar SQL queries. This article shows how to connect to Splunk data as a generic ODBC Data Provider and create charts, reports, and dashboards based on Splunk data in DBxtra.

Connect to Splunk Data

1. If you have not already done so, provide values for the required connection properties in the data source name (DSN). You can configure the DSN using the built-in Microsoft ODBC Data Source Administrator. This is also the last step of the driver installation. See the "Getting Started" chapter in the Help documentation for a guide to using the Microsoft ODBC Data Source Administrator to create and configure a DSN.
   
   

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   When you configure the DSN, you may also want to set the Max Rows connection property. This will limit the number of rows returned, which is especially helpful for improving performance when designing reports and visualizations.

2. Open the DBxtra application and in the New menu click Project and name the Project.
3. Select ODBC Connection as the Data Connection Type.
4. Click the browse option () for the Data Source.
5. In the Data Link Properties window, select Microsoft OLE DB Provider for ODBC Drivers on the Provider tab.
6. On the Connection tab, select the Data Source Name and the initial catalog to use (CData).
7. Name the Connection and select the appropriate User Groups.
8. Double-click the Connection from within the Project to connect to the data.

Create a Dashboard with Splunk Data

You are now ready to create a dashboard with Splunk data.

1. Right-click Report Objects under the Project and select New Report Object.
2. In the new Report Object, click the link to create the Query.
3. In the Select Data Connection window, select the newly created data connection.
4. On the Query tab, expand the connection objects and select the Tables, Views, and specific columns you wish to include in your dashboard. You can specify search requirements and even create complex queries which include JOINs and aggregations.
5. On the Dashboard tab, select the visualizations and features for your dashboard. Assign the data values from the query to the appropriate fields for the Dashboards items (Values, Series, etc.)

With a new Dashboard created, you are ready to begin analysis of Splunk data. Thanks to the ODBC Driver for Splunk, you can refresh the Dashboard and immediately see any changes made at the source. In the same way, you can create and view Reports with live, up-to-date Splunk data.