The Splunk ADO.NET Data Provider enables user to easily connect to Splunk data from .NET applications. Rapidly create and deploy powerful .NET applications that integrate with Splunk data including Datamodels, Datasets, SearchJobs, and more!
Splunk .NET Connectivity Features
- Powerful metadata querying enables SQL-like access to non-database sources
- Push down query optimization pushes SQL operations down to the server whenever possible, increasing performance
- Client-side query execution engine, supports SQL-92 operations that are not available server-side
- Connect to live Splunk data, for real-time data access with the Splunk JDBC Driver
- Full support for data aggregation and complex JOINs in SQL queries
- Secure connectivity through modern cryptography, including TLS 1.2, SHA-256, ECC, etc.
- Seamless integration with leading BI, reporting, and ETL tools and with custom applications via the Splunk Connector.
Target Service, API
The driver connects to Splunk REST API. Data platform for logs and metrics.
Schema, Data Model
Models Splunk data as searchable tables. Index and search based.
Key Objects
Indexes, Saved Searches, and Lookup Tables. Machine data access.
Operations
Search queries through SQL. No direct data modification. Real-time searches.
Authentication
Username/password or token authentication. Search capabilities required.
See what you can do with Splunk ADO.NET provider
Use Splunk from SQL Server Analysis Service (SSAS) multi-dimensional cubes. Keep your analytical data modeling and access to any source including cloud and on-premises.
The Splunk ADO.NET Provider allows developers to build applications that connect to Splunk using familiar SQL and Entity Framework. Integrate Splunk to your mission -critical applications or create easy side-by-side applications.
You can connect from ADO.NET compliant low-code development tools:
You can connect Splunk from .NET-based reporting and analytics tools:
Standard ADO.NET Access to Splunk
The Splunk ADO.NET Provider offers the most natural way to access Splunk data from any .NET application. Simply use Splunk Data Provider objects to connect and access data just as you would access any traditional database. You will be able to use the Splunk Data Provider through Visual Studio Server Explorer, in code through familiar classes, and in data controls like DataGridView, GridView, DataSet, etc.
The CData ADO.NET Provider for Splunk hides the complexity of accessing data and provides additional powerful security features, smart caching, batching, socket management, and more.
Working with DataAdapters, DataSets, DataTables, etc.
The Splunk Data Provider has the same ADO.NET architecture as the native .NET data providers for SQL Server and OLEDB, including: SplunkConnection, SplunkCommand, SplunkDataAdapter, SplunkDataReader, SplunkDataSource, SplunkParameter, etc. Because of this you can now access Splunk data in an easy, familiar way.
For example:
using (SplunkConnection conn = new SplunkConnection("...")) {
string select = "SELECT * FROM Datamodels";
SplunkCommand cmd = new SplunkCommand(select, conn);
SplunkDataAdapter adapter = new SplunkDataAdapter(cmd);
using (adapter) {
DataTable table = new DataTable();
adapter.Fill(table);
...
}
}
More Than Read-Only: Full Update/CRUD Support
Splunk Data Provider goes beyond read-only functionality to deliver full support for Create, Read, Update, and Delete operations (CRUD). Your end-users can interact with the data presented by the Splunk Data Provider as easily as interacting with a database table.
using (SplunkConnection connection = new SplunkConnection(connectionString)) {
SplunkDataAdapter dataAdapter = new SplunkDataAdapter(
"SELECT Id, Where FROM Datamodels", connection);
dataAdapter.UpdateCommand = new SplunkCommand(
"UPDATE Datamodels SET Where = @Where " +
"WHERE Id = @ID", connection);
dataAdapter.UpdateCommand.Parameters.AddWithValue("@Where", "Where");
dataAdapter.UpdateCommand.Parameters.AddWithValue("@Id", "80000173-1387137645");
DataTable DatamodelsTable = new DataTable();
dataAdapter.Fill(DatamodelsTable);
DataRow firstrow = DatamodelsTable.Rows[0];
firstrow["Where"] = "New Location";
dataAdapter.Update(DatamodelsTable);
}
ADO.NET Provider Performance
With traditional approaches to remote access, performance bottlenecks can spell disaster for applications. Regardless if an application is created for internal use, a commercial project, web, or mobile application, slow performance can rapidly lead to project failure. Accessing data from any remote source has the potential to create these problems. Common issues include:
- Network Connections - Slow network connections and latency issues are common in mobile applications.
- Service Delays - Delays due to service interruptions, resulting in server hardware or software updates.
- Large Data - Intentional or unintentional requests for large amounts of data.
- Disconnects - Complete loss of network connectivity.
The CData ADO.NET Provider for Splunk solves these issues by supporting powerful smart caching technology that can greatly improve the performance and dramatically reduce application bottlenecks.
Smart Caching
Smart caching is a configurable option that works by storing queried data into a local database. Enabling smart caching creates a persistent local cache database that contains a replica of data retrieved from the remote source. The cache database is small, lightweight, blazing-fast, and it can be shared by multiple connections as persistent storage.
Caching with our ADO.NET Providers is highly configurable, including options for:
- Auto Cache - Maintain an automatic local cache of data on all requests. The provider will automatically load data into the cache database each time you execute a SELECT query. Each row returned by the query will be inserted or updated as necessary into the corresponding table in the cache database.
- Explicit Cache - Cache only on demand. Developers decide exactly what data gets stored in the cache and when it is updated. Explicit caching provides full control over the cache contents by using explicit execution of CACHE statements.
- No Cache - All requests access only live data and no local cache file is created.
This powerful caching functionality increases application performance and allows applications to disconnect and continue limited functioning without writing code for additional local storage and/or data serialization/deserialization.
More information about ADO.NET Provider caching and best caching practices is available in the included help files.
Visual Studio Integration & Server Explorer
Working with the new Splunk ADO.NET Provider is easy. As a fully-managed .NET Data Provider, the Splunk Data Provider integrates seamlessly with the Visual Studio development environment as well as any .NET application.
As an ADO.NET Data Provider, Splunk ADO.NET Provider can be used to access and explore Splunk data directly from the Visual Studio Server Explorer.
It's easy. As a standard ADO.NET adapter, developers can connect the Server Explorer to Splunk ADO.NET Provider just like connecting to any standard database.
- Add a new Data Connection from the Server Explorer and select the Splunk Data Source
- Configure the basic connection properties to access your Splunk account data.
Explore all of the data available! Splunk ADO.NET Provider makes it easy to access live Splunk data from Visual Studio.
- After configuring the connection, explore the feeds, views, and services provided by the Splunk Data Source.
- These constructs return live Splunk data that developers can work with directly from within Visual Studio!
Developer Integration: Databind to Splunk
Connecting Web, Desktop, and Mobile .NET applications with Splunk is just like working with SQL Server. It is even possible to integrate Splunk ADO.NET Provider into applications without writing code.
Developers are free to access the Splunk ADO.NET Provider in whatever way they like best. Either visually through the Visual Studio Winforms or Webforms designers, or directly through code.
- Developers can connect the Splunk Data Source directly to form components by configuring the object's smart
tags.
- Add a new Data Connection from the Server Explorer and select the Splunk Data Source. Then, select the
feed, view, or services you would like to connect the object to.
Done! It's just like connecting to SQL Server.
- Once the object is bound to the data source, applications can easily interact with Splunk data with full
read/write (CRUD) support.
Popular ADO Videos:
