Build Splunk-Connected Dashboards in Redash

Redash lets you connect and query your data sources, build dashboards to visualize data and share them with your company. When paired with CData Connect Server, you get instant, cloud-to-cloud access to Splunk data for visualizations, dashboards, and more. This article shows how to create a virtual database for Splunk and build visualizations from Splunk data in Redash.

CData Connect Server provides a pure SQL Server interface for Splunk, allowing you to easily build reports from live Splunk data in Redash — without replicating the data to a natively supported database. As you build visualizations, Redash generates SQL queries to gather data. Using optimized data processing out of the box, CData Connect Server pushes all supported SQL operations (filters, JOINs, etc) directly to Splunk, leveraging server-side processing to quickly return the requested Splunk data.

Create a Virtual SQL Server Database for Splunk Data

CData Connect Server uses a straightforward, point-and-click interface to connect to data sources and generate APIs.

1. Login to Connect Server and click Connections.
2. Select "Splunk" from Available Data Sources.
3. Enter the necessary authentication properties to connect to Splunk.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

4. Click Save Changes
5. Click Privileges -> Add and add the new user (or an existing user) with the appropriate permissions.

With the virtual database created, you are ready to connect to Splunk data from Redash.

Visualize Splunk Data in Redash

The steps below outline creating a new data source in Redash based on the virtual Splunk database in Connect Server and building a simple visualization from the data.

Create a New Data Source

1. Log into Redash, click on your profile and click "Data Sources"
2. Click the " New Data Source" button
3. Select "Microsoft SQL Server" as the Data Source Type
4. On the configuration tab, set the following properties:
   • Name: Name the data source (e.g. Splunk (CData Connect))
   • Host: The full URL to your CData Connect instance (e.g. https://connect_server_url)
   • Port: The port of the CData Connect SQL Server endpoint (e.g. 1433)
   • User: A CData Connect user
   • Password: The password for the above user
   • Database name: The name of the virtual database for Splunk (e.g. Splunk1)
   • Click the checkbox to Use SSQL
5. Click Create
6. Click the "Test Connection" button to ensure you have configured the connection properly

With the new Data Source created, we are ready to visualize our Splunk data.

Create a Splunk Data Visualization

1. Click Create -> New Query
2. Select the newly created Data Source (you can explore the data structure in the New Query wizard)
3. Write a SQL statement to retrieve the data, for example:
   SELECT Name, Owner FROM DataModels
4. Click the "Execute" button to load Splunk data into Redash via CData Connect
5. Use the Visualization Editor to create and analyze graphs from Splunk data
6. You can schedule the query to refresh and update the visualization periodically

SQL Access to Splunk Data from Cloud Applications

At this point, you have a direct, cloud-to-cloud connection to Splunk data from Redash. You can create new visualizations, build dashboards, and more. For more information on gaining SQL access to data from more than 100 SaaS, Big Data, and NoSQL sources from cloud applications like Redash, refer to our Connect Server page.