Missing Fields in Splunk Reports when Connecting from Tableau


I'm trying to connect Tableau to Splunk. I have a number of searches saved as reports. Only 6 or 7 of them are working as data sources in Tableau. And one of those only works intermittently. Please keep in mind that I am not on the Splunk administration team so I have also submitted my questions to them. All of the reports appear to have the same permissions set.

In the 6 or 7 that are working, I see all the fields. In the ones that are not working, I see only the _time and timespan fields. Is there some permission that needs to be set on the index or in the back-end of Splunk that I don't have access to? My boss has asked me to try to recreate some of our Splunk dashboards in Tableau. While I have told him, it would be easier to just connect to the source of the data (e.g., SQL Server), he wants to be able to connect to Splunk, too.

I'd appreciate any assistance.


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...