Rapidly Develop Splunk-Driven Apps with Active Query Builder

Write standard .NET to expose Splunk data through an SQL interface: Active Query Builder helps developers write SQL interfaces; the CData ODBC Driver for Splunk enables standards-based access to Splunk. This integration uses the Microsoft ADO.NET Provider for ODBC as a bridge between the ODBC Driver and the Active Query Builder objects to build a visual SQL composer.

Connect to Splunk as an ODBC Data Source

If you have not already, first specify connection properties in an ODBC DSN (data source name). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Use SQL to Interact with Splunk

Follow the steps below to create a WinForms visual query builder.

1. Open Active Query Builder for .NET WinForms.
2. In the new Windows Forms project go to the "File" menu and click "Connect..."
3. Under Database Connections, click "Add..."
4. Set your desired Connection Name (e.g. CData Splunk), set Connection Type to "ODBC" and locate your previously configured DSN in the "User/System" DSN dropdown.
5. Click "OK" to save the new connection.
6. Back in the Database Connection wizard, select the newly created connection and click "OK."
7. Click "File" > "New Query" to create a QueryBuilder

You can now build queries visually: Double-click a table in the Columns Pane Area and an entity/relationship diagram is displayed in the Query Building Area. Columns that you select in the diagram are added to the query.