How to update Splunk from Excel

The CData Excel Add-In for Splunk enables you to edit and save Splunk data directly from Excel. This article explains how to transfer data from Excel to Splunk. This technique is useful if you want to work on Splunk data in Excel and update changes, or if you have a whole spreadsheet you want to import into Splunk. In this example, you will use the DataModels table; however, the same process will work for any table that can be retrieved by the CData Excel Add-In.

Establish a Connection

If you have not already done so, create a new Splunk connection by clicking From Splunk on the ribbon.

To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

Retrieve Data from Splunk

To insert data into Splunk, you will first need to retrieve data from the Splunk table you want to add to. This links the Excel spreadsheet to the Splunk table selected: After you retrieve data, any changes you make to the data are highlighted in red.

1. Click the From Splunk button on the CData ribbon. The Data Selection wizard is displayed.
2. In the Table or View menu, select the DataModels table.
3. In the Maximum Rows menu, select the number of rows you want to retrieve. If you want to insert rows, you need to retrieve only one row. The Query box will then display the SQL query that corresponds to your request.
4. In the Sheet Name box, enter the name for the sheet that will be populated. By default the add-in will create a new sheet with the name of the table.

Insert Rows to Splunk

After retrieving data, you can add data from an existing spreadsheet in Excel.

1. In a cell after the last row, enter a formula referencing the corresponding cell from the other spreadsheet; for example, . 👁 A local copy of a table. One row will be inserted. (QuickBooks is shown.)
   
2. After using a formula to reference the cells you want to add to Splunk, select the cells that you are inserting data into and drag the formula down as far as needed. The referenced values you want to add will be displayed on the DataModels sheet. 👁 The range of changes to update. (QuickBooks is shown.)
   
3. Highlight the rows you want to insert and click the Update Rows button.

As each row is inserted, the Id value will appear in the Id column and the row's text will change to black, indicating that the record has been inserted.