Prepare, Blend, and Analyze Splunk Data in Alteryx Designer (ODBC)

The CData ODBC driver for Splunk enables access to live data from Splunk under the ODBC standard, allowing you work with Splunk data in a wide variety of BI, reporting, and ETL tools and directly, using familiar SQL queries. This article shows how to connect to Splunk data using an ODBC connection in Alteryx Designer to perform self-service BI, data preparation, data blending, and advanced analytics.

The CData ODBC drivers offer unmatched performance for interacting with live Splunk data in Alteryx Designer due to optimized data processing built into the driver. When you issue complex SQL queries from Alteryx Designer to Splunk, the driver pushes supported SQL operations, like filters and aggregations, directly to Splunk and utilizes the embedded SQL engine to process unsupported operations (often SQL functions and JOIN operations) client-side. With built-in dynamic metadata querying, you can visualize and analyze Splunk data using native Alteryx data field types.

Connect to Splunk Data

1. If you have not already done so, provide values for the required connection properties in the data source name (DSN). You can configure the DSN using the built-in Microsoft ODBC Data Source Administrator. This is also the last step of the driver installation. See the "Getting Started" chapter in the Help documentation for a guide to using the Microsoft ODBC Data Source Administrator to create and configure a DSN.
   
   

   To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

   The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

   If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

   When you configure the DSN, you may also want to set the Max Rows connection property. This will limit the number of rows returned, which is especially helpful for improving performance when designing reports and visualizations.

👁 Configuring the DSN (Salesforce is shown.)

2. Open Alteryx Designer and create a new workflow.
3. If your application is set to run in DCM Mode Only by default, you need to change it to DCM Mode Optional to enable the CData ODBC Driver connection:
   1. Open Options > User Settings > Edit User Settings 👁 Opening User Settings
      
   2. Set the DCM Mode to "DCM Optional" and SDK Access Mode to "Allow" or "AllowAll" 👁 Overriding DCM Settings
      
4. Drag and drop a new input data tool onto the workflow.
👁 Add a new Input Data tool to the Workflow.

5. Click the drop down under Connect a File or Database and select the Data sources tab.
👁 Navigate to the Data sources tab.

6. Navigate tot he end of the page and click on "ODBC" under "Generic connection" 👁 Select New ODBC Connection.
   
7. Select the DSN (CData Splunk Source) that you configured for use in Alteryx.
👁 Select the configured DSN.

8. In the wizard that opens, drag, and drop the table to be queried in the "Query Builder box." Select the fields by checking the boxes that you wish to include in your query. Where possible, the complex queries generated by the filters and aggregations will be pushed down to Splunk, while any unsupported operations (which can include SQL functions and JOIN operations) will be managed client-side by the CData SQL engine embedded in the connector.
👁 Select table(s) and field(s) (Salesforce is shown).


If you wish to further customize your dataset, you can open the SQL Editor and modify the query manually, adding clauses, aggregations, and other operations to ensure that you are retrieving exactly the Splunk data you want .

👁 Modify the query in the SQL Editor.

With the query defined, you are ready to work with Splunk data in Alteryx Designer.

Perform Self-Service Analytics on Splunk Data

You are now ready to create a workflow to prepare, blend, and analyze Splunk data. The CData ODBC Driver performs dynamic metadata discovery, presenting data using Alteryx data field types and allowing you to leverage the Designer's tools to manipulate data as needed and build meaningful datasets. In the example below, you will cleanse and browse data.

1. Add a data cleansing tool to the workflow and check the boxes in Replace Nulls to replace null text fields with blanks and replace null numeric fields with 0. You can also check the box in Remove Unwanted Characters to remove leading and trailing whitespace.
👁 Add and configure a new Data Cleansing tool.

2. Add a browse data tool to the workflow.
👁 Add a new Data Browse tool.

3. Click to run the workflow (CTRL+R).
👁 Run the workflow.

4. Browse your cleansed Splunk data in the results view.
👁 Browse the results of the Workflow (Salesforce is shown.)

Thanks to built-in, high-performance data processing, you will be able to quickly cleanse, transform, and/or analyze your Splunk data with Alteryx.