Bridge Splunk Connectivity with Apache NiFi

Apache NiFi supports powerful and scalable directed graphs of data routing, transformation, and system mediation logic. When paired with the CData JDBC Driver for Splunk, NiFi can work with live Splunk data. This article describes how to connect to and query Splunk data from an Apache NiFi Flow.

With built-in optimized data processing, the CData JDBC driver offers unmatched performance for interacting with live Splunk data. When you issue complex SQL queries to Splunk, the driver pushes supported SQL operations, like filters and aggregations, directly to Splunk and utilizes the embedded SQL engine to process unsupported operations client-side (often SQL functions and JOIN operations). Its built-in dynamic metadata querying allows you to work with and analyze Splunk data using native data types.

Connecting to Splunk Data in Apache NiFi

1. Download the CData JDBC Driver for Splunk installer, unzip the package, run the .exe file to install the driver.

2. Copy the CData JDBC Driver JAR file (and license file if it exists), cdata.jdbc.splunk.jar (and cdata.jdbc.splunk.lic), to the Apache NiFi lib subfolder, for example, C:\nifi-1.3.0-bin\nifi-1.3.0\lib.

   On Windows, the default location for the CData JDBC Driver is C:\Program Files\CData\CData JDBC Driver for Splunk.

3. Start Apache NiFi by running the run-nifi.bat file in bin subfolder, for example, C:\nifi-1.3.0-bin\nifi-1.3.0\bin.

   (OR)

   Use the command prompt to navigate to the particular directory and run the run-nifi.bat file for example:

   cd C:\nifi-1.3.0-bin\nifi-1.3.0\bin
   .\run-nifi.bat
   

4. Navigate to the Apache NiFi UI in your web browser: It should be https://localhost:8443/nifi.

   Note: If users are utilizing an older version of Apache NiFi, they should access it via http://localhost:8080/nifi. In earlier versions, HTTP was the protocol employed. However, in the most recent version, HTTPS is the standard. By default, HTTP operates on port 8080, while HTTPS uses port 8443.

5. When accessing Apache NiFi via a URL, it prompts you to enter a username and password for login.

   To retrieve login credentials, users should consult the 'App.log' file located within the log directory of their NiFi installation. This file typically contains the necessary details for accessing the NiFi interface.

6. Right-click on the Nifi Flow's workspace and click "Controller Services"
7. Click the button to create a new controller service.
8. In the Controller Services section, location the newly created "DBCPConnection Pool" and click the menu () >> Edit to configure the new connection.

9. Fill in the properties:

   • Database Connection URL: jdbc:splunk:user=MyUserName;password=MyPassword;URL=MyURL;InitiateOAuth=GETANDREFRESH
   • Database Driver Class Name: cdata.jdbc.splunk.SplunkDriver
   • Database Driver Location(s): Path to your Apache NiFi's lib folder where the JAR files are present.

   Built-in Connection String Designer

   For assistance in constructing the JDBC URL, use the connection string designer built into the Splunk JDBC Driver. Either double-click the JAR file or execute the JAR file from the command-line.

   java -jar cdata.jdbc.splunk.jar

   Fill in the connection properties and copy the connection string to the clipboard.

   To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

10. In the Controller Services section, locate the newly created DBCPConnection Pool and click the menu () >> Enable to enable the new connection.
11. In the "Enable Controller Service" window, set Scope to "Service and referencing components"
12. To establish a connection and execute a select query, simply drag and drop the processor (indicated by the yellow highlight) into the workspace.
13. Select the 'ExecuteSQL' processor and click the 'Add' button to make it visible in the workspace.
14. Double-click on the added processor (ExecuteSQL)to open the connection page.
15. In the Properties section, fill in the required information. Make sure to set the Database Connection Pooling Service to match the DBCPConnectionPool that you have created, and set your desired SQL query that you want to get executed in the SQL select query section.
16. Go to Relationships and make sure to select an option on how the component should proceed in case of success and failure of the execution process.
17. You can enable the ExecuteSQL component by either selecting it and clicking Enable on the Operation section, or by right-clicking it and selecting Enable.

Your Splunk data is now available for use in Apache NiFi. For example, you can use the DBCPConnection Pool as the source for a QueryDatabaseTable processor (shown below).

Download a free, 30-day trial of the CData JDBC Driver for Splunk and start working with your live Splunk data in Apache NiFi. Reach out to our Support Team if you have any questions.