Splunk Search

Connecting Tableau to Splunk

flerlagekr
New Member

I am trying to connect Tableau to a Splunk instance. I know almost nothing about Splunk and am hoping some folks have had experience with this. My understanding, from the documentation, is that we have to first create some saved searches in Splunk. I've done that. My expectation was that, when I connect to Splunk in Tableau, it should then show me those saved searches as "tables". But when I connect, it just shows a blank screen. Any idea what I'm doing wrong?

alt text

0 Karma

nplamondon
SplunkTrust
SplunkTrust

Two things to start:

  • Make sure your user has access to the saved searches

  • Tableau only understands table-formatted search results, not visualizations.

0 Karma

flerlagekr
New Member

Thanks for the quick response! I actually created the saved search myself (with my own login) then used that same login for Tableau, so I'd assume I have access (I also fiddled with the security to make it available to more than just me). And the saved search was just a very simple table of columnar data.

0 Karma

nplamondon
SplunkTrust
SplunkTrust

And you're not getting any connection errors? It's been a while, but I recall the ODBC driver choking on Splunk messages (not errors, not relevant, but apparently show-stopping). Do you see your Tableau activity in _internal?

0 Karma

flerlagekr
New Member

No, it appears to connect without issue. No errors.

Not sure what you mean by seeing Tableau activity in _internal (sorry--I'm a Tableau guy and don't know much about Splunk).

0 Karma

nplamondon
SplunkTrust
SplunkTrust

I was able to work with one of my Tableau users today, and found something interesting. Tables aren't showing up for him, either, but he's able to use the browse function (top-right of the page) to find them. See anything using that route?

Sidenote: We have a convention of prepending these report names with "Exportable Data - " to differentiate reports intended for Tableau use from those that may not work in Tableau.

0 Karma

flerlagekr
New Member

I'm not seeing a browse button.

Is there a way to attach a screenshot here? If so I can show you what I see.

0 Karma

psmolinski
Loves-to-Learn

@flerlagekr Ken did you ever figure this out? I'm looking to connect to splunk data for the first time in Tableau as well. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...