Author and Share Power BI Reports on Real-Time Splunk Data

With built-in support for ODBC on Microsoft Windows, CData ODBC Drivers provide self-service integration with self-service analytics tools such as Microsoft Power BI. The CData ODBC Driver for Splunk links your Power BI reports to operational Splunk data. You can monitor Splunk data through dashboards and ensure that your analysis reflects Splunk data in real time by scheduling refreshes or refreshing on demand. This article details how to use the ODBC driver to create real-time visualizations of Splunk data in Microsoft Power BI Desktop and then upload to Power BI.

The CData ODBC Drivers offer unmatched performance for interacting with live Splunk data in Power BI due to optimized data processing built into the driver. When you issue complex SQL queries from Power BI to Splunk, the driver pushes supported SQL operations, like filters and aggregations, directly to Splunk and utilizes the embedded SQL Engine to process unsupported operations (often SQL functions and JOIN operations) client-side. With built-in dynamic metadata querying, you can visualize and analyze Splunk data using native Power BI data types.

Connect to Splunk as an ODBC Data Source

If you have not already, first specify connection properties in an ODBC DSN (data source name). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs.

To authenticate requests, set the User, Password, and URL properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

After creating a DSN, follow the steps below to connect to the Splunk DSN from Power BI Desktop:

1. Open Power BI Desktop and click Get Data -> ODBC. To start Power BI Desktop from PowerBI.com, click the download button and then click Power BI Desktop.
2. Select the DSN in the menu. If you know the SQL query you want to use to import, expand the Advanced Options node and enter the query in the SQL Statement box.
3. Select tables in the Navigator dialog.

4. Click Edit to edit the query. The table you imported is displayed in the Query Editor. In the Query Editor, you can enrich your local copy of Splunk data with other data sources, pivot Splunk columns, and more. Power BI detects each column's data type from the Splunk metadata retrieved by the driver.

   Power BI records your modifications to the query in the Applied Steps section, adjusting the underlying data retrieval query that is executed to the remote Splunk data. When you click Close and Apply, Power BI executes the data retrieval query.

   Otherwise, click Load to pull the data into Power BI.

Create Data Visualizations

After pulling the data into Power BI, you can create data visualizations in the Report view by dragging fields from the Fields pane onto the canvas. Follow the steps below to create a pie chart:

1. Select the pie chart icon in the Visualizations pane.
2. Select a dimension in the Fields pane: for example, Name.
3. Select a measure in the Owner in the Fields pane: for example, Owner.

You can change sort options by clicking the ellipsis (...) button for the chart. Options to select the sort column and change the sort order are displayed.

You can use both highlighting and filtering to focus on data. Filtering removes unfocused data from visualizations; highlighting dims unfocused data. You can highlight fields by clicking them:

You can apply filters at the page level, at the report level, or to a single visualization by dragging fields onto the Filters pane. To filter on the field's value, select one of the values that are displayed in the Filters pane.

Click Refresh to synchronize your report with any changes to the data.

Upload Splunk Data Reports to Power BI

You can share reports based on ODBC data sources with other Power BI users in your organization. To upload a dashboard or report, log into PowerBI.com, click Get Data -> Files, and navigate to a Power BI Desktop file or Excel workbook. You can then select the report in the Reports section.

Refresh on Schedule and on Demand

You can use the Power BI Personal Gateway to automatically refresh the dataset associated with your report. You can also refresh the dataset on demand in Power BI. After installing the Personal Gateway, follow the steps below to schedule refreshes for an ODBC DSN:

1. Log into Power BI.
2. In the Dataset section, right-click the Splunk Dataset.
3. Click Schedule Refresh.
4. In the settings for your dataset, expand the Data Source Credentials node and click Edit Credentials in the ODBC section.
5. Expand the Schedule Refresh section, select Yes in the Keep Your Data Up to Date menu, and specify the refresh interval.

You can now share real-time Splunk reports through Power BI.