How to Design Splunk Power Apps with Database-Like Connectivity

Microsoft Power Apps provides a drag and drop interface, underpinned by a rich set of formulas, for generating mobile and tablet apps that are connected to data. The CData API Server extends Power Apps with connectivity to remote data sources, without a need to maintain a separate copy of the data in the Power Apps Common Data Service. The CData API Server provides database-like connectivity for Splunk, augmenting the functionality of SaaS APIs and NoSQL databases with an in-memory SQL-92 engine.

The CData API Server also supports the Swagger metadata standard, whose UI-generation and code-generation possibilities are utilized across Azure App Service, Power Automate, and Power Apps. With Swagger, Power Apps generates a complete set of formulas for working with Splunk -- this article shows how to use these formulas to connect your PowerApp to remote Splunk data.

Set Up the API Server

If you have not already done so, download the CData API Server. Once you have installed the API Server, follow the steps below to begin producing secure Splunk OData services:

Connect to Splunk

To work with Splunk data from Microsoft Power Apps, we start by creating and configuring a Splunk connection. Follow the steps below to configure the API Server to connect to Splunk data:

1. First, navigate to the Connections page.
2. Click Add Connection and then search for and select the Splunk connection. 👁 Selecting a data source (SQLite is shown)
   
3. Enter the necessary authentication properties to connect to Splunk.

   To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   👁 Connecting to a datasource (SQLite is shown)
   
4. After configuring the connection, click Save & Test to confirm a successful connection.

Configure API Server Users

Next, create a user to access your Splunk data through the API Server. You can add and configure users on the Users page. Follow the steps below to configure and create a user:

1. On the Users page, click Add User to open the Add User dialog.
2. Next, set the Role, Username, and Privileges properties and then click Add User. 👁 Configure a new user
   
3. An Authtoken is then generated for the user. You can find the Authtoken and other information for each user on the Users page: 👁 API Server user settings
   

Creating API Endpoints for Splunk

Having created a user, you are ready to create API endpoints for the Splunk tables:

1. First, navigate to the API page and then click Add Table . 👁 Add tables
   
2. Select the connection you wish to access and click Next. 👁 Select the connection (SQLite is shown)
   
3. With the connection selected, create endpoints by selecting each table and then clicking Confirm. 👁 Adding tables from the connection (SQLite is shown)
   

Gather the OData Url

Having configured a connection to Splunk data, created a user, and added resources to the API Server, you now have an easily accessible REST API based on the OData protocol for those resources. From the API page in API Server, you can view and copy the API Endpoints for the API:

👁 API Endpoints

Retrieve the Swagger Metadata

You will use the metadata to create a Custom API connection. You can obtain the Swagger definition by making the following request in your browser and then saving the resulting JSON file:

http://MySite:MyPort/api.rsc/$oas?version=2

Connect to API Server in Power Apps

The following procedure shows how to create a simple app that searches remote Splunk data.

1. In Microsoft Power Apps, click Custom connectors.
2. Click Create custom connector and choose Import an OpenAPI file.
3. Name the connector, browse to the JSON file, and click Continue.
4. Fill in the relevant General information, ensure that Base URL is of the form /api.rsc/@myauthtoken (where myauthtoken is the AuthToken for a configure API Server user), and click Continue.
5. Select No authentication for the Authentication type. Click Continue.
6. Review the Action and Reference definitions and click Create connector.
7. To test the connector, you will need to create a new connection. Click Test, click New Connection under Connections, and click Create.
8. Navigate back to the connector from the Custom connectors menu and click Test. From here, you can test the available operations.

Connect Splunk to a Power App

Follow the steps below to connect to Splunk from a Power App:

1. From the Power Apps main menu, click Create an app and select the on-premises or cloud Power Apps Studio.
2. Select a blank app (choose Phone layout or Tablet layout).
3. In the View tab, click Data Sources and click Add data source.
4. Click the Connection you created to test the connector.

Populate a Gallery

Follow the steps below to create a simple app that can search Splunk data. You will use Power Apps formulas to bind Splunk rows to rows in a gallery control.

1. In the View tab, click Gallery -> Vertical to add a Gallery.

2. After selecting a gallery, assign the Items property of the gallery to Splunk data on the Advanced tab of the gallery settings. The formula below will allow you to access columns in the DataModels table.

   ForAll(CDataSwaggerAPI.getAllDataModels().value, {myName: Name, myOwner: Owner})

3. Assign Splunk columns to UI elements by clicking the element and then setting the Text property (on the Advanced tab of the UI element) to ThisItem.myName or ThisItem.myOwner.

   👁 Adding the connection to the layout.
   

Search Splunk Data

To filter the records displayed by the gallery, add a TextInput to your Screen, clear the Text property for the TextInput, and set the Items property of the gallery to a formula like the one below, replacing TextInput1 with the name of the TextInput control in your gallery, if necessary:

If(IsBlank(TextInput1.Text),
 ForAll(CDataSwaggerAPI.getAllDataModels().value, {myName: Name, myOwner: Owner}),
 ForAll(CDataSwaggerAPI.getAllDataModels({'$filter':Concatenate("contains(Name,",TextInput1.Text,")")}).value, {myName: Name, myOwner: Owner}))

The formula builds an OData query that the API Server executes against the remote Splunk data, ensuring that the search is run against the current data without first pulling in every record into the app. You can find more information on the supported OData in the API Server help documentation.

Edit Splunk Data

Follow the steps below to load an editable screen that shows the fields of the Splunk record selected in the gallery.

1. On the Insert tab, click New Screen->Blank and name the screen "Details".
2. Tie the gallery to the new screen: Select the arrow button in the first entry of the gallery and in the OnSelect field in the Advanced properties, enter the following:

   Navigate( Details, None )

3. In the Details screen, from the Insert tab, add a label "Id" and another label for the Id value. Set the Text property to BrowseGallery.Selected.Id

For each column you will need to do the following. Note that for Custom APIs form elements cannot detect which requests need to be formulated to the API Server, so you will need to write the data modification formulas manually.

1. Add a label for the field.
2. Add a text input from the Text menu to the screen and set the text property to the value from the selected item from the gallery (i.e.: BrowseGallery.Selected.myName).

To give your app basic update functionality and navigation, add Submit and Back buttons:

1. For the Submit button, set the OnChange property to the following:

   CDataSwaggerAPI.updateDataModels(BrowseGallery.Selected.myId,BrowseGallery.Selected.myId,{Name:TextInput1.Text,Owner:TextInput2.Text})

2. For the Back button, set the OnSelect field to the following:

   Navigate( BrowseScreen, None )

👁 Editable fields for a custom API.

Your mobile or tablet app can now browse, search, and update Splunk data.