Dashboards & Visualizations

How do I access data in Splunk via PowerBi?

hgarnica
Engager

I have a local install of SPlunk Enterprise 9.0.4.1 64bit, I installed the 64bit ODBC Driver and configured the data source. 

I then go to PowerBi to GetData via ODBC, I get a list of tables. When I select a table some data visible while some tables generate an error as follows:

DataSource.Error: ODBC: ERROR [HY000] [Splunk][SplunkODBC] (140) The saved search returned no results.
Details:
DataSourceKind=Odbc
DataSourcePath=dsn=Splunk ODBC
OdbcErrors=[Table]

I do not see find my data or field extractions from Splunk. Any ideas?

Screenshot 2023-05-09 094935.jpgScreenshot 2023-05-09 095033.jpg

Labels (1)
Tags (1)
0 Karma
1 Solution

hgarnica
Engager

You were correct, my search report needed modification in Splunk. Thereafter I was able to see the Table in PowerBi that was named the same as my Saved Search Report.

 

Thanks again, Hector

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Sometimes it's normal for a search to return no results.  It may be that there is no data that meets the search criteria.  This is especially true for searches that look for error conditions.

Have you tried running the search within Splunk to see what it returns?

---
If this reply helps you, Karma would be appreciated.
0 Karma

hgarnica
Engager

You were correct, my search report needed modification in Splunk. Thereafter I was able to see the Table in PowerBi that was named the same as my Saved Search Report.

 

Thanks again, Hector

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...