How to Connect to & Open Splunk Data in Microsoft Excel

The CData ODBC driver for Splunk uses the standard ODBC interface to link Splunk data with applications like Microsoft Access and Excel. Follow the steps below to use Microsoft Query to import Splunk data into a spreadsheet and provide values to a parameterized query from cells in a spreadsheet.

If you have not already, first specify connection properties in an ODBC DSN (data source name). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs.

To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

You can then work with live Splunk data in Excel.

NOTE: In recent versions of Excel, Microsoft Query is not visible by default. To enable visibility, Navigate to Options > Data and check From Microsoft Query (Legacy) under the Show legacy data import wizards section.

👁 Enabling Microsoft Query (Legacy).

1. In Excel, open the Data tab and choose Get Data -> Legacy Wizards -> From Microsoft Query (Legacy). 👁 Open Microsoft Query from the Data tab.
   
2. Choose the Splunk DSN. Select the option to use Query Wizard to create/edit queries. 👁 The list of available ODBC DSNs in the Choose Data Source dialog.
   
3. In the Query Wizard, expand the node for the table you would like to import into your spreadsheet. Select the columns you want to import and click the arrow to add them to your query. Alternatively, select the table name to add all columns for that table. 👁 Available tables and columns in the Choose Columns step of the Query Wizard. (Salesforce is shown.)
   
4. The Filter Data page allows you to specify criteria. For example, you can limit results by setting a date range. 👁 The Filter Data step of the Query Wizard. (Salesforce is shown.)
   
5. If you want to use parameters in your query, select the option to edit the query in Microsoft Query.

6. To set a parameter in the query, you will need to modify the SQL statement directly. To do this, click the SQL button in the Query Editor. If you set filter criteria earlier, you should have a WHERE clause already in the query.

   To use a parameter, use a "?" character as the wildcard character for a field's value in the WHERE clause. For example, if you are importing the DataModels, you can set "Id=?".

7. Close the SQL dialog when you are finished editing the SQL statement. You will be prompted to enter a parameter value. In the next step, you will select a cell to provide this value. So, leave the box in the dialog blank. 👁 The generated SQL statement. (Salesforce is shown.)
   

8. Click File -> Return Data to Microsoft Excel. The Import Data dialog is displayed. Enter a cell where results should be imported. 👁 The Import Data dialog.
   

9. Close the Import Data dialog. You will be prompted to enter a parameter value. Click the button next to the parameter box to select a cell. Select the option to automatically refresh the spreadsheet when the value changes.

The data is now imported into Excel. When you change the value in cell B1, the data will be filtered by the specified search criteria. 👁 The results of the query, with the search criteria applied. (Salesforce is shown.)