Connect to Splunk Data in RapidMiner

This article shows how you can easily integrate the CData JDBC driver for Splunk into your processes in RapidMiner. This article uses the CData JDBC Driver for Splunk to transfer Splunk data to a process in RapidMiner.

Connect to Splunk in RapidMiner as a JDBC Data Source

You can follow the procedure below to establish a JDBC connection to Splunk:

1. Add a new database driver for Splunk: Click Connections -> Manage Database Drivers.
2. In the resulting wizard, click the Add button and enter a name for the connection.
3. Enter the prefix for the JDBC URL: jdbc:splunk:
4. Enter the path to the cdata.jdbc.splunk.jar file, located in the lib subfolder of the installation directory.
5. Enter the driver class: cdata.jdbc.splunk.SplunkDriver
6. Create a new Splunk connection: Click Connections -> Manage Database Connections.
7. Enter a name for your connection.
8. For Database System, select the Splunk driver you configured previously.
9. Enter your connection string in the Host box.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   Built-in Connection String Designer

   For assistance in constructing the JDBC URL, use the connection string designer built into the Splunk JDBC Driver. Either double-click the JAR file or execute the jar file from the command-line.

   java -jar cdata.jdbc.splunk.jar

   Fill in the connection properties and copy the connection string to the clipboard.

   A typical connection string is below:

   user=MyUserName;password=MyPassword;URL=MyURL;InitiateOAuth=GETANDREFRESH
10. Enter your username and password if necessary.

You can now use your Splunk connection with the various RapidMiner operators in your process. To retrieve Splunk data, drag the Retrieve operator from the Operators view. With the Retrieve operator selected, you can then define which table to retrieve in the Parameters view by clicking the folder icon next to the "repository entry." In the resulting Repository Browser, you can expand your connection node to select the desired example set.

Finally, wire the output to the Retrieve process to a result, and run the process to see the Splunk data.