How to Query Splunk Data in MySQL Workbench

You can use the SQL Gateway from the ODBC Driver for Splunk to query Splunk data through a MySQL interface. Follow the procedure below to start the MySQL remoting service of the SQL Gateway and work with live Splunk data in MySQL Workbench.

Connect to Splunk Data

If you have not already done so, provide values for the required connection properties in the data source name (DSN). You can use the built-in Microsoft ODBC Data Source Administrator to configure the DSN. This is also the last step of the driver installation. See the "Getting Started" chapter in the help documentation for a guide to using the Microsoft ODBC Data Source Administrator to create and configure a DSN.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Configure the SQL Gateway

See the SQL Gateway Overview to set up connectivity to Splunk data as a virtual MySQL database. You will configure a MySQL remoting service that listens for MySQL requests from clients. The service can be configured in the SQL Gateway UI.

Query Splunk from MySQL Workbench

The steps below outline connecting to the virtual Splunk database created in the SQL Gateway from MySQL Workbench and issuing basic queries to work with live Splunk data.

Connect to Splunk through the SQL Gateway

1. In MySQL Workbench, click to add a new MySQL connection.
2. Name the connection (CData SQL Gateway for Splunk).
3. Set the Hostname, Port, and Username parameters to connect to the SQL Gateway.
4. Click Store in Vault to set and store the password.
5. Click Test Connection to ensure the connection is configured properly and click OK.

Query Splunk Data

1. Open the connection you just created (CData SQL Gateway for Splunk).
2. Click File -> New Query Tab.
3. Write a SQL query to retrieve Splunk data, like SELECT * FROM `CData Splunk Sys`.DataModels;

With access to live Splunk data from MySQL Workbench, you can easily query and update Splunk, just like you would a MySQL database. Get started now with a free, 30-day trial of the CData ODBC Driver for Splunk and the CData SQL Gateway.