Connecting to a Custom SQL Query

Tableau normally determines what query should be run against Splunk in order to build a visualization. However, these queries requres may request data than is needed, or you may need to use features specific to Splunk that Tableau does not expose. In these cases you can write a custom SQL query.

1. After you have connected to Splunk, navigate to the Data Source tab.
2. In the left pane, select your Database and Schema.
3. Instead of selecting one of the available tables, click New Custom SQL.
4. You are then be prompted for your query. Provide any filters aggregates or joins you want here.
5. Click OK.

With your custom SQL query provided, proceed to Visualizing Data as if the selection were a normal table.