This section describes how to edit the DSN configuration and then authenticate and connect to Splunk APIs.

DSN Configuration

You can use the Microsoft ODBC Data Source Administrator to edit the DSN configuration. Note that the installation process creates a both a user DSN and a system DSN, as described in Installing the Connector.

Note: The connector stores connection information in the Windows registry. To ensure that the connector can write to the registry, either run Power BI as an administrator or use a User DSN for your connection instead of a System DSN.

User DSN

Complete the following steps to edit the DSN configuration:

1. Select Start > Search, and enter ODBC Data Sources in the Search box.
2. Choose the version of the ODBC Administrator that corresponds to the bitness of your Power BI Desktop installation (32-bit or 64-bit).
3. Select the system data source and click Configure.
4. Edit the information on the Connection tab and click OK.

System DSN

Configure the system DSN the same way as the user DSN, except you will need to switch to the System DSN tab before performing Step 3.

Connecting to Splunk APIs

You must specify the URL to a valid Splunk server. By default the connector makes requests on port 8089.

By default, the connector attempts to negotiate TLS/SSL with the server. For more information on TLS/SSL configuration, see SSL Configuration.

Authenticating to Splunk

There are three ways to authenticate to Splunk: logging in with Splunk credentials, using a Splunk authentication token, or using an HTTP Event Collector (HEC) token. The HTTP Event Collector token is a special-purpose option that works with only a single stored procedure; review its requirements below before you select it.

Splunk Credentials

To authenticate with Splunk credentials, set User and Password to your login credentials.

Splunk Token

When you access Splunk via an authentication token, you can access the Splunk platform using Representational State Transfer (REST) calls. On Splunk Enterprise, you can also use the CLI. Both of these methods enable you to access the instance and make requests without having to authenticate via credentials.

Note: Unless you are accessing a search head cluster (where you can use the same token to access all available head clusters), you must have a separate token for each instance being accessed.

To authenticate with a Splunk token:

1. In the Splunk UI, navigate to Users and Authentication > Tokens to access your assigned authentication token. If you do not have one, request one from the administrator of the instance you want to access.
2. Set AuthScheme to AccessToken and the AccessToken property to your Splunk token.

HTTP Event Collector Token

The HTTP Event Collector (HEC) token authentication scheme is used exclusively to send events to Splunk through the HTTP Event Collector. When you set AuthScheme to HTTPEventCollectorToken, the connector can only call the CreateHTTPEvent stored procedure. You cannot query tables or views, run searches, or perform any other operation with this authentication scheme.

Before you use this authentication scheme, the HTTP Event Collector must be enabled on your Splunk instance, and the IP address of the machine running the connector (or, in a hosted environment, the egress IP addresses of the host) must be allowed in the HTTP Event Collector configuration on the Splunk side. Otherwise, requests are rejected.

To authenticate with an HTTP Event Collector token:

1. In the Splunk UI, navigate to Data Inputs > HTTP Event Collector to create or locate your token. If the collector is disabled, enable it and confirm that your client IP address is allowed.
2. Set AuthScheme to HTTPEventCollectorToken and set HTTPEventCollectorToken to your token value.