Qlik Community

Qlik Sense Enterprise Documents & Videos

Documents & videos about Qlik Sense.

Announcements
Qlik® Product Spotlight: Discover what’s possible. Get more from our products.
See for yourself. Register today.

Connecting to a Report in Splunk via an ODBC connection

richbyard
New Contributor III

Connecting to a Report in Splunk via an ODBC connection

This document outlines the steps to connect Qlik Sense to a report output in Splunk via the ODBC connection. This is a simple approach where the report can be scheduled in Splunk and the data loaded into Qlik Sense for visualization. This is an example approach to show connectivity.

In this example I have used a Splunk Light instance on a VM and loaded the sample data as provided by Splunk as part of their online tutorial.

Please note, this is a step-by-step guide aimed at those with minimal knowledge of Qlik and/or Splunk so please accept that it is documented as baby steps for beginners.

Setup Report in Splunk

  • In the Splunk interface setup a search and save as a Report. This approach provides an easy way to explore the data and return a dataset that is identifiable in the ODBC connection window.

1.png

  • Look at the Reports option in Splunk you will see your report in the list. In this example I have called the report ‘ReportSearch’.

2.png

Setup the Splunk ODBC driver

https://www.Splunk.com/en_us/solutions/solution-areas/business-analytics/odbc-driver.html

Run through the standard install process. You will be asked to enter the server details (include the port reference) and user credentials that the connection will use.

  • The resulting connection to the right will be created as a system DSN. This shows the serverSmiley Tongueort configuration that is required. In this case I have used an IP address but server name etc will also work.

3.png

  • To use a previously installed ODBC driver, find the ODBC administrator application on the Qlik Sense server or desktop. You will then be able to configure the connection as per the screenshot in point 4.

4.png

Connect Qlik Sense to Splunk through the ODBC connection

  • In a new Qlik Sense Application, click on the Add Data option.

5.png

  • Select ODBC from the list of connection options.

6.png

  • Select the Splunk ODBC connection you have created previously, enter the username and password credentials and enter a name for the connection that you can reuse in Qlik Sense.

7.png

  • The select data window will appear. Find the report name you saved in step 2 in the list on the left. Use the search function to make this easier. In this example the report name is ‘ReportSearch’. When selected the data will be previewed on the right hand side.

8.png

  • Click Prepare Data if you wish to rename fields, create calculated fields or join this data to additional datasets using the data profiler. Click Load Data and Finish if you just want to load the data and start to analyse it.

  • You can now start to create your dashboard from this data… Here’s a quick example based off this ReportSearch table using the tutorial data from Splunk.

9.png

Comments
analytica
New Contributor II

This is a great write-up thank you.

There are a lot of limitations with the Splunk ODBC connector:

  • Only works with saved searches in Splunk
  • Does not work with clustered Splunk servers
  • Performance is very slow due to the overhead of ODBC
  • I has issues with enterprise security especially when deployed on the Qlik Publisher

We actually wrote our own Splunk connector that solves these issues and works with live searches so you can do incremental loading.

Here's a link to it on Qlik Market and on our website:

vishnus85
Contributor
Version history
Revision #:
1 of 1
Last update:
‎01-31-2017 06:10 AM
Updated by: