How to Access Splunk Data Using Entity Framework

Microsoft Entity Framework serves as an object-relational mapping framework for working with data represented as objects. Although Visual Studio offers the ADO.NET Entity Data Model wizard to automatically generate the Entity Model, this model-first approach may present challenges when your data source undergoes changes or when you require greater control over entity operations. In this article, we will delve into the code-first approach for accessing Splunk data through the CData ADO.NET Provider, providing you with more flexibility and control.

1. Open Visual Studio and create a new Windows Form Application. This article uses a C# project with .NET 4.5.
2. Run the command 'Install-Package EntityFramework' in the Package Manger Console in Visual Studio to install the latest release of Entity Framework.

3. Modify the App.config file in the project to add a reference to the Splunk Entity Framework 6 assembly and the connection string.

   To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   <configuration>
    ... 
    <connectionStrings>
    <add name="SplunkContext" connectionString="Offline=False;user=MyUserName;password=MyPassword;URL=MyURL;InitiateOAuth=GETANDREFRESH;" providerName="System.Data.CData.Splunk" />
    </connectionStrings>
    <entityFramework>
    <providers>
    ... 
    <provider invariantName="System.Data.CData.Splunk" type="System.Data.CData.Splunk.SplunkProviderServices, System.Data.CData.Splunk.Entities.EF6" />
    </providers>
    <entityFramework>
   </configuration>
   </code> 
   

4. Add a reference to System.Data.CData.Splunk.Entities.EF6.dll, located in the lib -> 4.0 subfolder in the installation directory.
5. Build the project at this point to ensure everything is working correctly. Once that's done, you can start coding using Entity Framework.
6. Add a new .cs file to the project and add a class to it. This will be your database context, and it will extend the DbContext class. In the example, this class is named SplunkContext. The following code example overrides the OnModelCreating method to make the following changes:
   • Remove PluralizingTableNameConvention from the ModelBuilder Conventions.
   • Remove requests to the MigrationHistory table.

   using System.Data.Entity;
   using System.Data.Entity.Infrastructure;
   using System.Data.Entity.ModelConfiguration.Conventions;
   
   class SplunkContext : DbContext {
    public SplunkContext() { }
   
    protected override void OnModelCreating(DbModelBuilder modelBuilder)
    {
    // To remove the requests to the Migration History table
    Database.SetInitializer<SplunkContext>(null); 
    // To remove the plural names 
    modelBuilder.Conventions.Remove<PluralizingTableNameConvention>();
    } 
   }
   

7. Create another .cs file and name it after the Splunk entity you are retrieving, for example, DataModels. In this file, define both the Entity and the Entity Configuration, which will resemble the example below:

   using System.Data.Entity.ModelConfiguration;
   using System.ComponentModel.DataAnnotations.Schema;
   
   [System.ComponentModel.DataAnnotations.Schema.Table("DataModels")]
   public class DataModels {
    [System.ComponentModel.DataAnnotations.Key] 
    public System.String Name { get; set; }
    public System.String Owner { get; set; }
   }
    
   

8. Now that you have created an entity, add the entity to your context class:

   public DbSet<DataModels> DataModels { set; get; }
   

9. With the context and entity finished, you are now ready to query the data in a separate class. For example:

   SplunkContext context = new SplunkContext();
   context.Configuration.UseDatabaseNullSemantics = true;
   var query = from line in context.DataModels select line;