Qlik Community

Ask a Question

Qlik Sense Documents

Qlik Sense documentation and resources.

Talk to Experts Tuesday, January 26th at 10AM EST: Qlik Sense. REGISTER NOW

Connecting to a Report in Splunk via an ODBC connection

Contributor III
Contributor III

Connecting to a Report in Splunk via an ODBC connection

This document outlines the steps to connect Qlik Sense to a report output in Splunk via the ODBC connection. This is a simple approach where the report can be scheduled in Splunk and the data loaded into Qlik Sense for visualization. This is an example approach to show connectivity.

In this example I have used a Splunk Light instance on a VM and loaded the sample data as provided by Splunk as part of their online tutorial.

Please note, this is a step-by-step guide aimed at those with minimal knowledge of Qlik and/or Splunk so please accept that it is documented as baby steps for beginners.

Setup Report in Splunk

  • In the Splunk interface setup a search and save as a Report. This approach provides an easy way to explore the data and return a dataset that is identifiable in the ODBC connection window.


  • Look at the Reports option in Splunk you will see your report in the list. In this example I have called the report ‘ReportSearch’.


Setup the Splunk ODBC driver


Run through the standard install process. You will be asked to enter the server details (include the port reference) and user credentials that the connection will use.

  • The resulting connection to the right will be created as a system DSN. This shows the server:port configuration that is required. In this case I have used an IP address but server name etc will also work.


  • To use a previously installed ODBC driver, find the ODBC administrator application on the Qlik Sense server or desktop. You will then be able to configure the connection as per the screenshot in point 4.


Connect Qlik Sense to Splunk through the ODBC connection

  • In a new Qlik Sense Application, click on the Add Data option.


  • Select ODBC from the list of connection options.


  • Select the Splunk ODBC connection you have created previously, enter the username and password credentials and enter a name for the connection that you can reuse in Qlik Sense.


  • The select data window will appear. Find the report name you saved in step 2 in the list on the left. Use the search function to make this easier. In this example the report name is ‘ReportSearch’. When selected the data will be previewed on the right hand side.


  • Click Prepare Data if you wish to rename fields, create calculated fields or join this data to additional datasets using the data profiler. Click Load Data and Finish if you just want to load the data and start to analyse it.

  • You can now start to create your dashboard from this data… Here’s a quick example based off this ReportSearch table using the tutorial data from Splunk.


Contributor II
Contributor II

This is a great write-up thank you.

There are a lot of limitations with the Splunk ODBC connector:

  • Only works with saved searches in Splunk
  • Does not work with clustered Splunk servers
  • Performance is very slow due to the overhead of ODBC
  • I has issues with enterprise security especially when deployed on the Qlik Publisher

We actually wrote our own Splunk connector that solves these issues and works with live searches so you can do incremental loading.

Here's a link to it on Qlik Market and on our website:

Version history
Revision #:
1 of 1
Last update:
‎2017-01-31 06:10 AM
Updated by: