How to Create Power BI Visual Reports with Real-Time Splunk Data

CData Power BI Connectors provide self-service integration with Microsoft Power BI. The CData Power BI Connector for Splunk links your Power BI reports to real-time Splunk data. You can monitor Splunk data through dashboards and ensure that your analysis reflects Splunk data in real time by scheduling refreshes or refreshing on demand. This article details how to use the Power BI Connector to create real-time visualizations of Splunk data in Microsoft Power BI Desktop.

If you are interested in publishing reports on Splunk data to PowerBI.com, refer to our other Knowledge Base article.

Collaborative Query Processing

The CData Power BI Connectors offer unmatched performance for interacting with live Splunk data in Power BI due to optimized data processing built into the connector. When you issue complex SQL queries from Power BI to Splunk, the connector pushes supported SQL operations, like filters and aggregations, directly to Splunk and utilizes the embedded SQL Engine to process unsupported operations (often SQL functions and JOIN operations) client-side. With built-in dynamic metadata querying, you can visualize and analyze Splunk data using native Power BI data types.

Connect to Splunk as a Power BI Data Source

Installing the Power BI Connector creates a DSN (data source name) called CData Power BI Splunk. This the name of the DSN that Power BI uses to request a connection to the data source. Configure the DSN by filling in the required connection properties.

You can use the Microsoft ODBC Data Source Administrator to create and configure the DSN: From the Start menu, enter "ODBC Data Sources" and select the CData PowerBI REST DSN. Ensure that you run the version of the ODBC Administrator that corresponds to the bitness of your Power BI Desktop installation (32-bit or 64-bit). You can also use run the ConfigureODBC.exe tool located in the installation folder for the connector.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

How to Query Splunk Tables

Follow the steps below to build a query to pull Splunk data into the report:

1. Open Power BI Desktop and click Get Data -> Other -> CData Splunk.
2. Select CData PowerBI Splunk in the Data Source Name menu and select a data connectivity mode:
   Select Import if you want to import a copy of the data into your project. You can refresh this data on demand.
   Select DirectQuery if you want to work with the remote data.
3. Select tables in the Navigator dialog.

4. In the Query Editor, you can customize your dataset by filtering, sorting, and summarizing Splunk columns. Click Edit to open the query editor. Right-click a row to filter the rows. Right-click a column header to perform actions like the following:

   • Change column data types
   • Remove a column
   • Group by columns

   Power BI detects each column's data type from the Splunk metadata retrieved by the connector.

   Power BI records your modifications to the query in the Applied Steps section, adjusting the underlying data retrieval query that is executed to the remote Splunk data. When you click Close and Apply, Power BI executes the data retrieval query.

   Otherwise, click Load to pull the data into Power BI.

How to Create Data Visualizations in Power BI

After pulling the data into Power BI, you can create data visualizations in the Report view by dragging fields from the Fields pane onto the canvas. Follow the steps below to create a pie chart:

1. Select the pie chart icon in the Visualizations pane.
2. Select a dimension in the Fields pane: for example, Name.
3. Select a measure in the Fields pane: for example, Owner.

You can change sort options by clicking the ellipsis (...) button for the chart. Options to select the sort column and change the sort order are displayed.

You can use both highlighting and filtering to focus on data. Filtering removes unfocused data from visualizations; highlighting dims unfocused data. You can highlight fields by clicking them:

You can apply filters at the page level, at the report level, or to a single visualization by dragging fields onto the Filters pane. To filter on the field's value, select one of the values that are displayed in the Filters pane.

Click Refresh to synchronize your report with any changes to the data.

At this point, you will have a Power BI report built on top of live Splunk data. Learn more about the CData Power BI Connectors for Splunk and download a free trial from the CData Power BI Connector for Splunk page. Let our Support Team know if you have any questions.