LINQ to Splunk Data

Ready to get started?

Download for a free trial:

Download Now

Learn more:

Splunk ADO.NET Provider

Rapidly create and deploy powerful .NET applications that integrate with Splunk data including Datamodels, Datasets, SearchJobs, and more!

In this article

Related articles


LINQ provides general-purpose query facilities in .NET Framework 3.0 and above and provides one easy way to programmatically access data through from CData ADO.NET Data Providers. This example uses LINQ to access information from the Splunk Data Provider.

This article demonstrates how to use LINQ to access Splunk tables through the CData ADO.NET Data Provider for Splunk. To do this you will LINQ to Entity Framework, which is used to generate the connection and can be used with any CData ADO.NET Data Providers to access data via LINQ.

See the help documentation for a guide to setting up an EF 6 project to use the provider.

  1. In a new project in Visual Studio, right-click on the project and choose to add a new item. Add an ADO.NET Entity Data Model.
  2. Choose EF Designer from Database and click Next.
  3. Add a new Data Connection, and change your data source type to "CData Splunk Data Source".

  4. Enter your data source connection information.

    To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

    The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

    If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

    Below is a typical connection string:

    user=MyUserName;password=MyPassword;URL=MyURL;InitiateOAuth=GETANDREFRESH
  5. If saving your entity connection to App.Config, set an entity name. In this example we are setting SplunkEntities as our entity connection in App.Config.
  6. Enter a model name and select any tables or views you would like to include in the model.

Using the entity you created, you can now perform select , update, delete, and insert commands. For example:

SplunkEntities context = new SplunkEntities(); var datamodelsQuery = from datamodels in context.DataModels select datamodels; foreach (var result in datamodelsQuery) { Console.WriteLine("{0} {1} ", result.Id, result.Name); }

See "LINQ and Entity Framework" chapter in the help documentation for example queries of the supported LINQ.