Query Splunk Data in MySQL Workbench

MySQL Workbench allows users to administer MySQL environments and gain better visibility into databases. When paired with CData Connect (on-premise or Connect Server), you get live access to Splunk data as if it were a MySQL database. This article shows how to create a virtual database for Splunk in Connect and work with live Splunk data in MySQL Workbench.

Create a Virtual MySQL Database for Splunk Data

CData Connect uses a straightforward, point-and-click interface to connect to data sources and generate APIs.

1. Login to Connect and click Connections.
2. Select "Splunk" from Available Data Sources.
3. Enter the necessary authentication properties to connect to Splunk.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

4. Click Save Changes
5. Click Privileges -> Add and add the new user (or an existing user) with the appropriate permissions.

With the virtual database created, you are ready to connect to Splunk from MySQL Workbench.

Query Splunk from MySQL Workbench

The steps below outline connecting to the virtual Splunk database in Connect from MySQL Workbench and issuing basic queries to work with live Splunk data.

Connect to Splunk through Connect

1. In MySQL Workbench, click to add a new MySQL connection.
2. Name the connection (CData Connect).
3. Set the Hostname, Port, and Username parameters to connect to the SQL Gateway.
4. Click Store in Vault to set and store the password.
5. Click Test Connection to ensure the connection is configured properly and click OK.

Query Splunk Data

1. Open the connection you just created (CData Connect).
2. Click File -> New Query Tab.
3. Write a SQL query to retrieve Splunk data, like SELECT * FROM splunkdb.DataModels;

With access to live Splunk data from MySQL Workbench, you can easily query and update Splunk, just like you would a MySQL database. Request a demo of the CData Connect and start working with Splunk just like a MySQL database today.