Access Live Splunk Data in TIBCO Data Virtualization

TIBCO Data Virtualization (TDV) is an enterprise data virtualization solution that orchestrates access to multiple and varied data sources. When paired with the Splunk Tibco DV Adapter, you get federated access to live Splunk data directly within TIBCO Data Virtualization. This article explains how to deploy an adapter and create a new data source based on Splunk.

With built-in optimized data processing, the CData TIBCO DV Adapter offers unmatched performance for interacting with live Splunk data. When you issue complex SQL queries to Splunk, the adapter pushes supported SQL operations, like filters and aggregations, directly to Splunk. Its built-in dynamic metadata querying allows you to work with and analyze Splunk data using native data types.

Deploy the Splunk TIBCO DV Adapter

1. In a console, navigate to the bin folder in the TDV Server installation directory. If there is a current version of the adapter installed, you will need to undeploy it.

   .\server_util.bat -server localhost -user admin -password ******** -undeploy -version 1 -name Splunk
   

2. Extract the CData TIBCO DV Adapter to a local folder and deploy the JAR file (tdv.splunk.jar) to the server from the extract location.

   .\server_util.bat -server localhost -user admin -password ******** -deploy -package /PATH/TO/tdv.splunk.jar
   

You may need to restart the server to ensure the new JAR file is loaded properly, which can be accomplished by running the composite.bat script located at: C:\Program Files\TIBCO\TDV Server <version>\bin. Note that reauthenticating to the TDV Studio is required after restarting the server.

Sample Restart Call

.\composite.bat monitor restart

Authenticate with Splunk Using OAuth

Since Splunk authenticates using the OAuth protocol and TDV Studio does not support browser-based authentication internally, you will need to create and run a simple Java application to retrieve the OAuth tokens. Once retrieved, the tokens are used to connect to Splunk directly from the adapter.

Create the Java Application

1. Create a new Java file with preferred name for example GenOAuthSettings.java. This Java file leverages the SplunkOAuth class contained within the TDV Adapter JAR to initiate a test connection and perform the required OAuth authentication flow
2. Copy and insert the following code into the .java file:

public class GenOAuthSettings {
 public static void main(String[] args) {
 try {
 	 if (args.length != 2) {
 			throw new Exception("Input must have two arguments: 'data source', 'connection string'");
 		}
 
 		String source = args[0].replace(" ", "").toLowerCase();
 		String connectionString = args[1];
 		String prefix;
 
 		if (source.equals("splunk")) {
 			prefix = "jdbc:splunk:";
 
 			com.cdata.cis.splunk.SplunkOAuth oauth = new com.cdata.cis.splunk.SplunkOAuth();
 
 			if (!connectionString.startsWith(prefix)) connectionString = prefix + connectionString;
 			oauth.generateOAuthSettingsFile(connectionString);
 		}
 		// More sources can be added below using the same format. You must add the import statement and ensure the jar file resides in the classpath
			// else if (source.equals("googlebigquery") || source.equals("bigquery")) {
			// prefix = "jdbc:googlebigquery:";
			//
			// com.cdata.cis.googlebigquery.GoogleBigQueryOAuth oauth = new com.cdata.cis.googlebigquery.GoogleBigQueryOAuth();
			//
			// if (!connectionString.startsWith(prefix)) connectionString = prefix + connectionString;
			// oauth.generateOAuthSettingsFile(connectionString);
			// }
 		else {
				throw new Exception("Data Source not supported. Available Data Sources: Splunk");
			}
			
			System.out.println("Test Connection Successful!");
		} catch (Exception e) {
			e.printStackTrace();
		}
	}
}

3. Place the .java file in the same directory as the tdv.splunk.jar file. This is required to prevent classpath resolution errors during compilation and execution

Build and run the Java Application

1. Open Console and navigate to the directory containing the .java file and adapter jar
2. Compile the Java file using the following command:

javac -cp .;tdv.splunk.jar GenOAuthSettings.java

3. Execute the application using one of the following commands:

java -cp .;tdv.splunk.jar GenOAuthSettings "Splunk" "connection string"

This command initiates the OAuth authentication flow and generates the OAuth settings file at the location specified in the OAuthSettingsLocation parameter. Once you deploy the adapter and authenticate, you can create a new data source for Splunk in TDV Studio.

Create a Splunk Data Source in TDV Studio

With the Splunk Tibco DV Adapter, you can easily create a data source for Splunk and introspect the data source to add resources to TDV.

Create the Data Source

1. Right-click on the folder you wish to add the data source to and select New -> New Data Source
2. Scroll until you find the adapter (e.g. Splunk) and click Next
3. Name the data source (e.g. CData Splunk Source)
4. Fill in the required connection properties

To authenticate requests, set the , , and properties to valid Splunk credentials. The port on which the requests are made to Splunk is port 8089.

The data provider uses plain-text authentication by default, since the data provider attempts to negotiate TLS/SSL with the server.

If you need to manually configure TLS/SSL, see Getting Started -> Advanced Settings in the data provider help documentation.

NOTE: Ensure that the OAuthSettingsLocation property in the DV Adapter is set to the same file path used during the OAuth authentication process. Additionally, set the InitiateOAuth property to REFRESH so that the adapter can automatically handle OAuth access-token refreshes in the background without requiring any user action.

👁 Filling in Connection Information (Salesforce is shown.)

5. Click Create & Close.

Introspect the Data Source

Once the data source is created, you can introspect the data source by right-clicking and selecting Open. In the dashboard, click Add/Remove Resources and select the Tables, Views, and Stored Procedures to include as part of the data source. Click Next and Finish to add the selected Splunk tables, views, and stored procedures as resources.

After creating and introspecting the data source, you are ready to work with Splunk data in TIBCO Data Virtualization just like you would any other relational data source. You can create views, query using SQL, publish the data source, and more.