Build Visualizations of Splunk Data in Birst

Birst is a cloud business intelligence (BI) tool and analytics platform that helps organizations quickly understand and optimize complex processes. When paired with the CData JDBC Driver for Splunk, you can connect to live Splunk data through the Birst Cloud Agent and build real-time visualizations. In this article, we walk you through, step-by-step, how to connect to Splunk using the Cloud Agent and create dynamic reports in Birst.

With powerful data processing capabilities, the CData JDBC driver offers unmatched performance for live Splunk data operations in Birst. When you issue complex SQL queries from Birst to Splunk, the driver pushes supported SQL operations, like filters and aggregations, directly to Splunk and utilizes the embedded SQL Engine to process unsupported operations client-side (often SQL functions and JOIN operations). With built-in dynamic metadata querying, the JDBC driver enables you to visualize and analyze Splunk data using native Birst data types.

Configure a JDBC Connection to Splunk Data in Birst

Before creating the Birst project, you will need to install the Birst Cloud Agent (in order to work with the installed JDBC Driver). Also, copy the JAR file for the JDBC Driver (and the LIC file, if it exists) to the /drivers/ directory in the installation location for the Cloud Agent.

With the driver and Cloud Agent installed, you are ready to begin.

1. Create a new project in Birst. 👁 Create a new Project in Birst
   
2. Name the connection (e.g. CDataSplunk).
3. Choose Live Access.
4. Select an agent.
5. Set Database Type to Other.
👁 Configure the Connection (part 1)

6. Set SQL Type to MSSQL
7. Set the Connection string.

   To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   Built-in Connection String Designer

   For assistance in constructing the JDBC URL, use the connection string designer built into the Splunk JDBC Driver. Either double-click the JAR file or execute the jar file from the command-line.

   java -jar cdata.jdbc.splunk.jar
   

   Fill in the connection properties and copy the connection string to the clipboard.

   👁 Using the built-in connection string designer to generate a JDBC URL (Salesforce is shown.)
   

   When you configure the JDBC URL, you may also want to set the Max Rows connection property. This will limit the number of rows returned, which is especially helpful for improving performance when designing reports and visualizations.

   Below is a typical JDBC connection string for Splunk:

   jdbc:splunk:user=MyUserName;password=MyPassword;URL=MyURL;InitiateOAuth=GETANDREFRESH;
   
   

8. Set the Driver Name: cdata.jdbc.splunk.SplunkDriver and click Save.

NOTE: Since authentication to Splunk is managed from the connection string, you can leave Security Credentials blank.

Configure Splunk Data Objects

Now that the connection is configured, we are ready to configure the schema for the dataset, choosing the tables, views, and columns we wish to visualize.

1. Select the Schema (e.g. Splunk).
2. Click on Tables and/or Views to connect to those entities and click Apply.
3. Select the Tables and Columns you want to access and click Done.

With the objects configured, you can perform any data preparation and discover any relationships in your data using the Pronto Prepare and Relate tools.

Build a Visualization

After you prepare your data and define relationships between the connected objects, you are ready to build your visualization.

1. Select the Visualizer tool from the menu.
👁 Select the Visualizer

2. Select Measures & Categories from your objects
3. Select and configure the appropriate visualization for the Measure(s) you selected.

Using the CData JDBC Driver for Splunk with the Cloud Agent and Birst, you can easily create robust visualizations and reports on Splunk data. Download a free, 30-day trial and start building Birst visualizations today.