VOOZH about

URL: https://www.cdata.com/kb/tech/splunk-cloud-power-query.rst

⇱ Work with Live Splunk Data in Power Query


Work with Live Splunk Data in Power Query

πŸ‘ Jerod Johnson
Jerod Johnson
Director, Technology Evangelism
Use CData Connect AI to connect to Splunk data and work with live Splunk data in Microsoft Power Query.

Power Query is a data transformation and data preparation engine. When paired with CData Connect AI, you get instant, cloud-to-cloud access to Splunk data from Power Query. This article shows how to connect to Connect AI from Power Query through Microsoft Excel and get live access to Splunk data for transformation and preparation.

CData Connect AI provides a pure SQL, cloud-to-cloud interface for Splunk, allowing you to easily integrate with live Splunk data in Power Query β€” without replicating the data. CData Connect AI looks exactly like a SQL Server database to Power Query and uses optimized data processing out of the box to push all supported SQL operations (filters, JOINs, etc) directly to Splunk, leveraging server-side processing to quickly return Splunk data.

Configure Splunk Connectivity for Power Query

Connectivity to Splunk from Power Query is made possible through CData Connect AI. To work with Splunk data from Power Query, we start by creating and configuring a Splunk connection.

  1. Log into Connect AI, click Sources, and then click Add Connection
  2. πŸ‘ Adding a Connection
  3. Select "Splunk" from the Add Connection panel
  4. πŸ‘ Selecting a data source
  5. Enter the necessary authentication properties to connect to Splunk.

    To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

    The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

    If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

    πŸ‘ Configuring a connection (Salesforce is shown)
  6. Click Save & Test
  7. Navigate to the Permissions tab in the Add Splunk Connection page and update the User-based permissions. πŸ‘ Updating permissions

Add a Personal Access Token

When connecting to Connect AI through the REST API, the OData API, or the Virtual SQL Server, a Personal Access Token (PAT) is used to authenticate the connection to Connect AI. It is best practice to create a separate PAT for each service to maintain granularity of access.

  1. Click on the Gear icon () at the top right of the Connect AI app to open the settings page.
  2. On the Settings page, go to the Access Tokens section and click Create PAT.
  3. Give the PAT a name and click Create. πŸ‘ Creating a new PAT
  4. The personal access token is only visible at creation, so be sure to copy it and store it securely for future use.

With the connection configured and a PAT generated, you are ready to connect to Splunk data from Power Query.

Working with Live Splunk Data in Power Query

With the connection to Connect AI configured, you are ready to work with live Splunk data in Power Query.

  1. In Microsoft Excel, open the Power Query Editor (from the Data ribbon, click Get Data -> Launch Power Query Editor) πŸ‘ Opening the Power Query Editor
  2. Click New Source -> SQL Server πŸ‘ Creating a new SQL Server Source
  3. In the SQL Server database modal:
    • Set Server to tds.cdata.com,14333
    • (Optional) Set Database to the name of the Splunk connection (e.g. Splunk1 )
    πŸ‘ Configuring the Server
  4. In the SQL Server credentials modal, select "Database" and
    • Set User to your Connect AI username (e.g. [email protected] )
    • Set Password to the PAT for the above user
    πŸ‘ Configuring the credentials
  5. Click Connect
  6. Select the table(s) you wish to work with in the Navigator and click "OK" πŸ‘ Selecting the table(s) (Salesforce is shown)

At this point, you have live access to Splunk data from Power Query for transformation and preparation.

πŸ‘ Working with data in Power Query (Salesforce is shown)

SQL Access to Splunk Data

Now you have a direct connection to live Splunk data from Microsoft Power Query. You can create more connections and transform and preparte your data to better drive business β€” all without replicating Splunk data.

To get real-time data access to hundreds of SaaS, Big Data, and NoSQL sources directly from your cloud applications, sign up for a free trial of CData Connect AI.