View Reports on Real-Time Splunk Data in Power BI Report Server



Use the CData ODBC Driver for Splunk to visualize Splunk data in Power BI Desktop and then publish them to Power BI Report Server.

With built-in support for ODBC on Microsoft Windows, CData ODBC Drivers provide self-service integration with self-service analytics tools, such as Microsoft Power BI. The CData ODBC Driver for Splunk links your Power BI reports to operational Splunk data. You can monitor Splunk data through dashboards and ensure that your analysis reflects Splunk data in real time by scheduling refreshes or refreshing on demand. This article details how to use the ODBC driver to create real-time visualizations of Splunk data in Microsoft Power BI Desktop and then publish the visualizations to Power BI Report Server.

The CData ODBC Drivers offer unmatched performance for interacting with live Splunk data in Power BI due to optimized data processing built into the driver. When you issue complex SQL queries from Power BI to Splunk, the driver pushes supported SQL operations, such as filters and aggregations, directly to Splunk and uses the embedded SQL Engine to process unsupported operations (often SQL functions and JOIN operations) client-side. With built-in dynamic metadata querying, you can visualize and analyze Splunk data using native Power BI data types.

Connect to Splunk as an ODBC Data Source

If you have not already, first specify connection properties in an ODBC data source name (DSN). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs. To publish Power BI reports from Power BI Desktop to Power BI Report Server, you will need to install the ODBC Driver on both the client (desktop) and server machines, using the same name for the DSN on each machine.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

When you configure the DSN, you may also want to set the Max Rows connection property. This will limit the number of rows returned, which is especially helpful for improving performance when designing reports and visualizations.

After creating a DSN, follow the steps below to connect to the Splunk DSN from Power BI Desktop:

  1. Open Power BI Desktop and click Get Data -> ODBC. To start Power BI Desktop from PowerBI.com, click the download button and then click Power BI Desktop.
  2. Select a System DSN in the menu (necessary to publish to a Power BI Report Server). If you know the SQL query you want to use to import, expand the Advanced Options node and enter the query in the SQL Statement box.
  3. Select tables in the Navigator dialog.
  4. Click Edit to edit the query. The table you imported is displayed in the Query Editor. In the Query Editor, you can enrich your local copy of Splunk data with other data sources, pivot Splunk columns, and more. Power BI detects each column's data type from the Splunk metadata retrieved by the driver.

    Power BI records your modifications to the query in the Applied Steps section, adjusting the underlying data retrieval query that is executed to the remote Splunk data. When you click Close and Apply, Power BI executes the data retrieval query.

    Otherwise, click Load to pull the data into Power BI.

Create Data Visualizations

After pulling the data into Power BI, you can create data visualizations in the Report view by dragging fields from the Fields pane onto the canvas. Follow the steps below to create a pie chart:

  1. Select the pie chart icon in the Visualizations pane.
  2. Select a dimension in the Fields pane, for example, Name.
  3. Select a measure in the Owner in the Fields pane, for example, Owner. You can modify the visualization and the data used with the following techniques:
    • Change sort options by clicking the ellipsis (...) button for the chart. Options to select the sort column and change the sort order are displayed.
    • Use both highlighting and filtering to focus on data. Filtering removes unfocused data from visualizations; highlighting dims unfocused data. Highlight fields by clicking them.
    • Apply filters at the page level, at the report level, or to a single visualization by dragging fields onto the Filters pane. To filter on the field's value, select one of the values that are displayed in the Filters pane.
  4. Click Refresh to synchronize your report with any changes to the data and save your Power BI report to the client machine.

Upload Splunk Data Reports to Power BI Report Server

You can share reports based on ODBC data sources with other Power BI users in your organization using a Power BI Report Server.

  1. Install and configure the ODBC Driver for Splunk on the report server (see the instructions above).
  2. Log into the report server (typically found at http://MYSERVER/reports), click to upload a new report and select the report you just saved.
  3. View the Splunk report from any machine with access to the Report Server.

Ready to get started?

Download a free trial of the Splunk ODBC Driver to get started:

 Download Now

Learn more:

Splunk Icon Splunk ODBC Driver

The Splunk ODBC Driver is a powerful tool that allows you to connect with live Splunk, directly from any applications that support ODBC connectivity.

Access Splunk like you would a database - read, write, and update Datamodels, Datasets, SearchJobs, etc. through a standard ODBC Driver interface.