Hi Friends,
I am using Tableau to connect to SPLUNK saved searches. I am using ODBC driver Tableau 9.1 for this connection. However Tableau user is able to authenticate against SPLUNK but no data is being displayed.
Initially I thought it is an account or permission issue but I tried admin account but no luck. Did anyone else face the similar issue with tableau ?
Any suggestion is highly appreciated !
I am able to connect to splunk from Tableau without issue. I'm able to see the saves searches but am not able to see the results of the searches. I am able to see the results of the searches from the web interface, so it doesn't appear to be a permissions issue. Has anyone solved this?
I have the same problem with Tableau 10.
The connexion is working but there is not data at all
were you able to find an answer?
I have same issue.
Tableau 9.0
Splunk ODBC 2.1.0
Splunk 6.4
Not sure if it's related, but something we ran into, is that the Splunk ODBC driver seems to really want to use SSLv3, but due to POODLE, our load balancers had SSLv3 disabled. (It looked like Tableau had connected successfully with no data returned, but turning on tracing for ODBC we were able to see messages like: "[Splunk]SplunkODBC Error with HTTP API, error code: SSL connect error" (and Wireshark was able to tell us what was going on).
For a temporary workaround, I configured a reverse proxy on my local machine to perform the SSLv3 negotiation with SplunkODBC, but the forward on the HTTP requests to the Splunk API (which used TLS). But in the meantime I'm logging a ticket with Splunk to figure out how to configure this with the ODBC driver.
Case: 334302
Update from Splunk Support:
This is a known issue DVPL-6794: ODBC driver needs TLS 1.2 support
No time frame for the fix yet.
@acharlieh, thanks for your reply. I turned on tracing for ODBC and I noticed the same error. Please let me know if you get any response for your ticket.
@acharlieh, How did you configure reverse proxy? Did you do this on Windows? Thanks!
Yes this was on Windows. As my work has a license and I'm familiar with it, I personally used Charles Proxy, a Java based HTTP recording proxy, to pull the man-in-the-middle attack on myself to get things to work.
After installing Charles Proxy, you probably want to disable it from automatically starting Windows and Firefox proxies through Proxy > Proxy Settings > {Windows, Mozilla Firefox} preference panels to uncheck the "Enable at startup" flags.
Then you add a Reverse Proxy in Proxy > Reverse Proxies, ensure "Enable Reverse Proxies" is checked, then click "Add", pick an arbitrary local port, use (your load balancer host) as the remote host, and (your load balancer Splunk API port) as the remote port. Ensure that "Preserve Host Header" is not checked and click OK.
Then you enable SSL Proxying in Proxy > SSL Proxying, check the box to enable SSL Proxying, and add a Location of (your load balancer host).
Finally with Charles Proxy running, Launch Tableau... Instead of using https://(your load balancer host) you then use https://localhost and specify the arbitrary local port that you picked above when setting up the reverse proxy, and use your same Splunk username and password.
As it is essentially a MITM attack on yourself, you would not want to put this workaround in place for everyone as it's decrypting and re-encrypting all of the HTTPS traffic, but on your local machine for your own traffic that should be ok until you discuss with load balancer teams if enabling SSLv3 is an option or Splunk gets back to us.
I am running into the same problem. I am using Tableau 9.2, Splunk ODBC 2.0 & Splunk 6.2. I checked the logs. No exceptions or anything.
I can see the saved searches in the browser. https://splunk.xxxxx.com:8089/services/saved/searches.
Tableau is connected to Splunk but I don't see any data in Tableau.
Anyone solved this problem? Thanks!
Check the Tableau log files at C:/Users/[your user]/Documents/My Tableau Repository/Logs. I haven't resolved my issue, but the logs are helping understand what's happening.
SPLUNK authentication from Tableau works fine. I've created couple of savedsearch in global search application and custom applications, tableau does not display either of them.