Splunk

Applies to: Tableau Desktop, Tableau Prep

This article describes how to connect Tableau to Splunk data and set up a data source.

Note: The Splunk ODBC connector is compatible with Splunk Enterprise 6.

Before you begin

Before you begin, gather this connection information:

  • Server URL, including the name of the database, if there are multiple databases

  • User name and password

  • (Optional) Initial SQL statement to run every time Tableau connects

Use this connector with Tableau Desktop on a Windows computer.

Driver required

This connector requires a driver to talk to the database. You might already have the required driver installed on your computer. If the driver is not installed on your computer, Tableau displays a message in the connection dialog box with a link to the Driver Download(Link opens in a new window) page where you can find driver links and installation instructions.

Make the connection and set up the data source

  1. Start Tableau and under Connect, select Splunk. For a complete list of data connections, select More under To a Server. Then do the following:

    1. Enter the server URL. You should use HTTPS to connect to Splunk data.

      2. If your server contains multiple databases, enter the name of a specific database on the server.

      Note: Database names are case sensitive.

    2. Enter your user name and password.

    3. (Optional) Select Initial SQL to specify a SQL command to run at the beginning of every connection, such as when you open the workbook, refresh an extract, sign in to Tableau Server, or publish to Tableau Server. For more information, see Run Initial SQL.

    4. Select Sign In.

      If Tableau can't make the connection, verify that your credentials are correct. If you still can't connect, your computer is having trouble locating the server. Contact your network administrator or database administrator.

  2. On the data source page, do the following:

    1. (Optional) Select the default data source name at the top of the page, and then enter a unique data source name for use in Tableau. For example, use a data source naming convention that helps other users of the data source figure out which data source to connect to.

    2. Under Saved Search, enter a saved search name in the text box or select a saved search from the list, and drag it to the box at the top of the data source page.

    3. Select the sheet tab to start your analysis.

Join limitations with Splunk

While you cannot create a join between Splunk tables, you can combine Splunk data from multiple tables by doing one of the following:

  • Set up and connect to a saved search: Set up a saved search in Splunk that returns all the tables you need in a single search result. Then connect to this saved search from Tableau Desktop.

  • Use data blending: Set up a data source for each Splunk table you need, then use data blending to combine the data. For more information, see Blend Your Data.

  • Create an extract: Create an extract of each Splunk table and then join the extracts together using a cross-database join. For more information, Extract Your Data and Join Your Data.

However, you can create a cross-database join between Splunk data and data from different databases (or files) with one exception. After adding a new connection to the Tableau data source, you must double-click the table in the left pane to add it to the canvas. You cannot drag the table from the left pane to the canvas as you normally would when creating a cross-database join. For more information about cross-database joins, see Join Your Data.

Note: Creating a cross-database join between Splunk tables is not supported. A cross-database join between Splunk tables causes all the connections in the Tableau data source to disappear except for the last Splunk connection.

 

See also

Back to top
Thanks for your feedback!Your feedback has been successfully submitted. Thank you!