Access Live Splunk Data in TIBCO Data Virtualization

TIBCO Data Virtualization (TDV) is an enterprise data virtualization solution that orchestrates access to multiple and varied data sources. When paired with the CData TIBCO DV Adapter for Splunk, you get federated access to live Splunk data directly within TIBCO Data Virtualization. This article walks through deploying an adapter and creating a new data source based on Splunk.

With built-in optimized data processing, the CData TIBCO DV Adapter offers unmatched performance for interacting with live Splunk data. When you issue complex SQL queries to Splunk, the adapter pushes supported SQL operations, like filters and aggregations, directly to Splunk. Its built-in dynamic metadata querying allows you to work with and analyze Splunk data using native data types.

Deploy the Splunk TIBCO DV Adapter

1. In a console, navigate to the bin folder in the TDV Server installation directory. If there is a current version of the adapter installed, you will need to undeploy it.

   .\server_util.bat -server localhost -user admin -password ******** -undeploy -version 1 -name Splunk
   

2. Extract the CData TIBCO DV Adapter to a local folder and deploy the JAR file (tdv.splunk.jar) to the server from the extract location.

   .\server_util.bat -server localhost -user admin -password ******** -deploy -package /PATH/TO/tdv.splunk.jar
   

You may need to restart the server to ensure the new JAR file is loaded properly, which can be accomplished by running the composite.bat script located at: C:\Program Files\TIBCO\TDV Server <version>\bin. Note that reauthenticating to the TDV Studio is required after restarting the server.

Sample Restart Call

.\composite.bat monitor restart

Authenticate with Splunk Using OAuth

Since Splunk authenticates using the OAuth protocol and TDV Studio does not support browser-based authentication internally, you will need to create and run a simple Java application to retrieve the OAuth tokens. Once retrieved, the tokens are used to connect to Splunk directly from the adapter.

The following code sample shows how to authenticate with Splunk. You will simply need to execute the Java application with the tdv.splunk.jar file in the class path.

SplunkOAuth oauth = new SplunkOAuth();  
oauth.generateOAuthSettingsFile("InitiateOAuth=GETANDREFRESH;" + 
                                  "user=MyUserName;password=MyPassword;URL=MyURL;" + 
                                  "OAuthSettingsLocation=C:\splunk\OAuthSettings.txt;");

Once you deploy the adapter and authenticate, you can create a new data source for Splunk in TDV Studio.

Create a Splunk Data Source in TDV Studio

With the CData TIBCO DV Adapter for Splunk, you can easily create a data source for Splunk and introspect the data source to add resources to TDV.

Create the Data Source

1. Right-click on the folder you wish to add the data source to and select New -> New Data Source.
2. Scroll until you find the adapter (e.g. Splunk) and click Next.
3. Name the data source (e.g. CData Splunk Source).

4. Fill in the required connection properties.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   NOTE: Set the OAuthSettingsLocation property in the DV Adapter to the same value you used when performing the OAuth authentication (see above).

5. Click Create & Close.

Introspect the Data Source

Once the data source is created, you can introspect the data source by right-clicking and selecting Open. In the dashboard, click Add/Remove Resources and select the Tables, Views, and Stored Procedures to include as part of the data source. Click Next and Finish to add the selected Splunk tables, views, and stored procedures as resources.

After creating and introspecting the data source, you are ready to work with Splunk data in TIBCO Data Virtualization just like you would any other relational data source. You can create views, query using SQL, publish the data source, and more.