I'm trying to connect Tableau to Splunk. I have a number of searches saved as reports. Only 6 or 7 of them are working as data sources in Tableau. And one of those only works intermittently. Please keep in mind that I am not on the Splunk administration team so I have also submitted my questions to them. All of the reports appear to have the same permissions set.
In the 6 or 7 that are working, I see all the fields. In the ones that are not working, I see only the _time and timespan fields. Is there some permission that needs to be set on the index or in the back-end of Splunk that I don't have access to? My boss has asked me to try to recreate some of our Splunk dashboards in Tableau. While I have told him, it would be easier to just connect to the source of the data (e.g., SQL Server), he wants to be able to connect to Splunk, too.