Connecting to a Report in Splunk via an ODBC connection
This document outlines the steps to connect Qlik Sense to a report output in Splunk via the ODBC connection. This is a simple approach where the report can be scheduled in Splunk and the data loaded into Qlik Sense for visualization. This is an example approach to show connectivity.
In this example I have used a Splunk Light instance on a VM and loaded the sample data as provided by Splunk as part of their online tutorial.
Please note, this is a step-by-step guide aimed at those with minimal knowledge of Qlik and/or Splunk so please accept that it is documented as baby steps for beginners.
Setup Report in Splunk
In the Splunk interface setup a search and save as a Report. This approach provides an easy way to explore the data and return a dataset that is identifiable in the ODBC connection window.
Look at the Reports option in Splunk you will see your report in the list. In this example I have called the report ‘ReportSearch’.
Run through the standard install process. You will be asked to enter the server details (include the port reference) and user credentials that the connection will use.
The resulting connection to the right will be created as a system DSN. This shows the server:port configuration that is required. In this case I have used an IP address but server name etc will also work.
To use a previously installed ODBC driver, find the ODBC administrator application on the Qlik Sense server or desktop. You will then be able to configure the connection as per the screenshot in point 4.
Connect Qlik Sense to Splunk through the ODBC connection
In a new Qlik Sense Application, click on the Add Data option.
Select ODBC from the list of connection options.
Select the Splunk ODBC connection you have created previously, enter the username and password credentials and enter a name for the connection that you can reuse in Qlik Sense.
The select data window will appear. Find the report name you saved in step 2 in the list on the left. Use the search function to make this easier. In this example the report name is ‘ReportSearch’. When selected the data will be previewed on the right hand side.
Click Prepare Data if you wish to rename fields, create calculated fields or join this data to additional datasets using the data profiler. Click Load Data and Finish if you just want to load the data and start to analyse it.
You can now start to create your dashboard from this data… Here’s a quick example based off this ReportSearch table using the tutorial data from Splunk.