Rapidly Develop Splunk-Driven Apps with Active Query Builder

Write standard .NET to expose Splunk data through an SQL interface: Active Query Builder helps developers write SQL interfaces; the CData ODBC Driver for Splunk enables standards-based access to Splunk. This integration uses the Microsoft ADO.NET Provider for ODBC as a bridge between the ODBC Driver and the Active Query Builder objects to build a visual SQL composer.

Connect to Splunk as an ODBC Data Source

If you have not already, first specify connection properties in an ODBC DSN (data source name). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Use SQL to Interact with Splunk

Follow the steps below to create a WinForms visual query builder.

1. In a new Windows Forms project, drag the QueryBuilder from the Toolbox onto the form.
2. Add a reference to ActiveQueryBuilder.ODBCMetadataProvider.
3. Add an OdbcConnection and set the connection string to the DSN that you created in the first section. OdbcConnection connection = new OdbcConnection(); connection.ConnectionString = "DSN=Splunk"
4. Initialize ODBCMetadataProvider and GeneralSyntaxProvider instances and set the Connection property of the ODBCMetadataProvider object to the OdbcConnection. GenericSyntaxProvider syntaxProvider = new GenericSyntaxProvider(); ODBCMetadataProvider metadataProvider = new ODBCMetadataProvider(); metadataProvider.Connection = connection;
5. Set the corresponding MetadataProvider and SyntaxProvider properties of the QueryBuilder object. queryBuilder1.MetadataProvider = metadataProvider; queryBuilder1.SyntaxProvider = syntaxProvider;
6. Call the InitiatelizeDatabaseSchemaTree method of the QueryBuilder class to retrieve Splunk metadata and generate a tree view of Splunk tables. queryBuilder1.InitializeDatabaseSchemaTree();

7. After creating the QueryBuilder, connect it to a TextBox or, as we use, the ActiveQueryBuilder SQLTextEditor: Drag and drop an SQLTextEditor onto the designer.

8. Add the following code to the Validating event for the SQLTextEditor: private void sqlTextEditor1_Validating(object sender, CancelEventArgs e) { try { // Update the query builder with manually edited query text: queryBuilder1.SQL = sqlTextEditor1.Text; } catch (SQLParsingException ex) { e.Cancel = true; // Set caret to error position sqlTextEditor1.SelectionStart = ex.ErrorPos.pos; // Report error MessageBox.Show(ex.Message, "Parsing error"); } }
9. Add the following to the SQLUpdated event: private void queryBuilder1_SQLUpdated(object sender, EventArgs e) { sqlTextEditor1.Text = queryBuilder1.FormattedSQL; }

10. You can now build queries visually: Double-click a table in the Columns Pane Area and an entity/relationship diagram is displayed in the Query Building Area. Columns that you select in the diagram are added to the query.