After Installing the Connector you can connect and create a Data Source for data in Splunk.

Setting Up a Data Source

Complete the following steps to connect to the data:

1. Under Connect | To a Server, click More....
2. Select the data source called Splunk by CData.
3. Enter the information required for the connection.
4. Click Sign In.
5. If necessary, select a Database and Schema to discover what tables and views are available.

Using the Connection Builder

The connector makes the most common connection properties available directly in Tableau. However, it can be difficult to use if you need to use more advanced settings or need to troubleshoot connection issues. The connector includes a separate connection builder that allows you to create and test connections outside of Tableau.

There are two ways to access the connection builder:

• On Windows, use a shortcut called Connection Builder in the Start menu, under the CData Tableau Connector for Splunk folder.
• You can also start the connection builder by going to the driver install directory and running the .jar file in the lib directory.

In the connection builder, you can set values for connection properties and click Test Connection to validate that they work. You can also use the Copy to Clipboard button to save the connection string. This connection string can be given to the Connection String option included in the connector connection window in Tableau.

Connecting to Splunk APIs

You must specify the URL to a valid Splunk server. By default the connector makes requests on port 8089.

By default, the connector attempts to negotiate TLS/SSL with the server. For more information on TLS/SSL configuration, see SSL Configuration.

Authenticating to Splunk

There are two ways to authenticate to Splunk data: logging in with Splunk credentials, or using a Splunk authentication token.

Splunk Credentials

To authenticate with Splunk credentials, set User and Password to your login credentials.

Splunk Token

When you access Splunk via an authentication token, you can access the Splunk platform using Representational State Transfer (REST) calls. On Splunk Enterprise, you can also use the CLI. Both of these methods enable you to access the instance and make requests without having to authenticate via credentials.

Note: Unless you are accessing a search head cluster (where you can use the same token to access all available head clusters), you must have a separate token for each instance being accessed.

To authenticate with a Splunk token:

1. In the Splunk UI, navigate to Users and Authentication > Tokens to access your assigned authentication token. If you do not have one, request one from the administrator of the instance you want to access.
2. Set the AuthScheme to AccessToken; and the AccessToken property to your Splunk token.

Next Step

See Using the Connector to create data visualizations.