Analyze Splunk Data in Looker

Looker is a business intelligence and big data analytics platform that helps you explore, analyze and share real-time business analytics. When paired with CData Connect Cloud, you get instant, cloud-to-cloud access to Splunk data for business applications. This article shows how to connect to Splunk in Connect Cloud and then connect to Splunk data in Looker.

CData Connect Cloud provides a pure cloud-to-cloud interface for Splunk, allowing you to build reports from live Splunk data in Looker — without replicating the data to a natively supported database. As you create applications to work with data, Looker generates SQL queries to gather data. Using optimized data processing out of the box, CData Connect Cloud pushes all supported SQL operations (filters, JOINs, etc.) directly to Splunk, leveraging server-side processing to quickly return the requested Splunk data.

Configure Splunk Connectivity for Looker

Connectivity to Splunk from Looker is made possible through CData Connect Cloud. To work with Splunk data from Looker, we start by creating and configuring a Splunk connection.

1. Log into Connect Cloud, click Connections and click Add Connection
2. Select "Splunk" from the Add Connection panel
3. Enter the necessary authentication properties to connect to Splunk.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

4. Click Create & Test
5. Navigate to the Permissions tab in the Add Splunk Connection page and update the User-based permissions.

Add a Personal Access Token

If you are connecting from a service, application, platform, or framework that does not support OAuth authentication, you can create a Personal Access Token (PAT) to use for authentication. Best practices would dictate that you create a separate PAT for each service, to maintain granularity of access.

1. Click on your username at the top right of the Connect Cloud app and click User Profile.
2. On the User Profile page, scroll down to the Personal Access Tokens section and click Create PAT.
3. Give your PAT a name and click Create.
4. The personal access token is only visible at creation, so be sure to copy it and store it securely for future use.

With the connection configured, you are ready to connect to Splunk data from Looker.

Connect to Splunk in Looker

The steps below outline connecting to CData Connect Cloud from Looker to create a new Splunk data source.

1. Log-in to Looker
2. In the navigation pane, select Admin.
3. Under the Database category, select Connections.
4. On the Connections page, click Add Connection.
5. Enter the connection settings:
   • Name: the name for the connection in models.
   • Dialect: select Microsoft SQL Server 2017+.
   • SSH Server: leave this disabled.
   • Remote Host:Port: enter tds.cdata.com in the first field and 14333 in the second field.
   • Database: enter the Connection Name of the CData Connect Cloud data source you want to connect to (for example, QuickBooksOnline1).
   • Username: enter your CData Connect Cloud username. This is displayed in the top-right corner of the CData Connect Cloud interface. For example, test@cdata.com
   • Password: enter the PAT you generated on the Settings page
   Leave the rest of the connection settings at their default values unless you need to modify them.
6. At the bottom of the page, click Test These Settings to ensure that you can connect to CData Connect Cloud.
7. Click Add Connection to create the connection and return to the Connections page.

Your connection is now available for use in Looker. To connect to additional data sources from your CData Connect Cloud account, repeat the setup steps above, changing the value for Database for each data source.

Creating A Looker Visualization From The SQL Runner and Explore Features

To create a visualization in Looker using the SQL Runner, follow these steps:

1. In the Looker interface, select Develop -> SQL Runner from the left navigation pane.
2. On the SQL Runner interface, select the connection you made in the previous steps.
3. Now, click the gear symbol next to a table and then select Explore Table.
4. Next, on the left menu, select fields from the table and click Run. You can now expand the Visualization accordion, and see a bar chart, by default.

   We have now created a visualization of Splunk data in Looker using CData Connect Cloud!

Get CData Connect Cloud

To get live data access to 100+ SaaS, Big Data, and NoSQL sources directly from your cloud applications, try CData Connect Cloud today!