topic Re: Qlik Sense connectivity with Splunk in Connectivity & Data Prep

Qlik Sense connectivity with Splunk

jaisoni_trp — Thu, 22 Dec 2016 20:38:54 GMT

We would like to read data from Splunk as a source type and checking if anyone is already using them. I guess as per Qlik they don't officially support the Splunk ODBC connectors or provide data connectors for the same.

Re: Qlik Sense connectivity with Splunk

lironbaram — Thu, 22 Dec 2016 20:44:02 GMT

i manage to use splunk odbc to read data ,

but splunk ODBC only work when all splunk parts are installed on the same machine ,

in large volumes this wouldn't be the case , in my case we settled on writing the splunk query

to text file and them reading it to Qlik

Re: Qlik Sense connectivity with Splunk

jaisoni_trp — Fri, 23 Dec 2016 12:46:38 GMT

Hi Liron,

Could you please throw some light on below points:

a) but splunk ODBC only work when all splunk parts are installed on the same machine -- What are the splunk parts we need to install and i believe machine you are referring to would Qlik Sense hosts.

b) we settled on writing the splunk query to text file and them reading it to Qlik -- Are you not generating sql in Qlik Sense connecting splunk odbc drivers?

Re: Qlik Sense connectivity with Splunk

lironbaram — Fri, 23 Dec 2016 12:55:56 GMT

first point on the qlik sense server you'll need splunk odbc

the question is how splunk is setup. if all the installation of the splunk is on one machine the ODBC will work

otherwise it won't

because of the first problem we used command line tools to fetch data from splunk that we run with batch file

Re: Qlik Sense connectivity with Splunk

Anonymous — Wed, 10 May 2017 20:14:04 GMT

Hi Jai -

There are a lot of limitations with the Splunk ODBC connector:

Only works with saved searches in Splunk
Does not work with clustered Splunk servers
Performance is very slow due to the overhead of ODBC
I has issues with enterprise security especially when deployed on the Qlik Publisher

We actually wrote our own Splunk connector for Qlik that solves these issues and works with live searches so you can do incremental loading. Here's a link to it on Qlik Market and on our website:

Thanks,

Steve