Access Live Splunk Data in SAS JMP via ODBC

You can use the CData ODBC Driver for Splunk to integrate live data into your statistical analysis with SAS JMP. The driver proxies your queries directly to the Splunk API, ensuring that your analysis reflects any changes to the data. The CData ODBC Driver supports the standard SQL used by JMP in the background as you design reports.

The Splunk API supports bidirectional access. This article shows how to access Splunk data into a report and create data visualization. It also shows how to use SQL to query and manipulate Splunk data from the JMP Query Builder.

Access Splunk Data as an ODBC Data Source

If you have not already, first specify connection properties in an ODBC DSN (data source name). This is the last step of the driver installation. You can use the Microsoft ODBC Data Source Administrator to create and configure ODBC DSNs.

To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

When you configure the DSN, you may also want to set the Max Rows connection property. This will limit the number of rows returned, which is especially helpful for improving performance when designing reports and visualizations.

Import Splunk Data with the Query Builder

After you have created the Splunk DSN, you can use SQL to invoke the capabilities of the Splunk API. Follow the steps below to execute some supported queries in the Query Builder:

1. In SAS JMP, click File -> Database -> Query Builder. The Select Database Connection dialog is displayed.
2. Click New Connection.
3. On the Machine Data Source tab, select the ODBC DSN you configured and then click Next. 👁 Select the ODBC DSN you configured. (Salesforce is shown.)
   
4. The Select Tables for Query dialog is displayed and in the Available Tables section, select a table and click Primary. After choosing the primary table, click Build Query to open the Query Builder. 👁 Select the Primary table for the Query. (Salesforce is shown.)
   
5. As you drag Available Columns to the Included Columns tab, the underlying SQL query is updated and you can view the generated SQL Query in the SQL tab. 👁 The generated query in the Query Builder. (Salesforce is shown.)
   
6. Click Run Query to display the data. 👁 The results of a query in the Query Builder. (Salesforce is shown.)
   
7. To refresh the results with the current data, right-click Update from Database and click Run Script.

Manipulate Splunk Data

You can execute data manipulation queries from JSL scripts such as the one below. To execute a script, click New Script in the toolbar. To connect, specify the DSN. You can then use the standard SQL syntax:

Open Database( "DSN=CData Splunk Source;",
"INSERT INTO DataModels
(Id)
VALUES ('SampleDataset');");

Visualize Splunk Data

After importing, you can use the Graph Builder to create graphs visually. To open the Graph Builder, click the Graph Builder button in the toolbar.

1. Drag a dimension column onto the x axis. For example, Name.
2. Drag a measure column onto the y axis. For example, Owner.
3. Select a chart type. For example, a bar chart. 👁 Configuration of a basic chart. (Salesforce is shown.)