Splunk

Applies from 2021.3

Alation has certified the Splunk data source with the following CData driver to support additional features:

  • cdata.jdbc.splunk.SplunkDriver.cdata.jdbc.splunk

Alation can provide the above mentioned CData driver license for Splunk. Refer to How to get a CData Driver and use the scenario appropriate to your case.

Scope of Support

  • Supported as Custom DB with the CData Driver for Splunk.

  • Metadata Extraction (MDE)

    • Automated MDE

  • Compose

  • Data Profiling

  • QLI is not supported

Ports

Port 8089 must be open.

Service Account

Create the service account for Splunk, refer to Create a User. Make sure that the user has the Admin role assigned.

Required Information

  • JDBC driver used to connect to the database: CData JDBC Driver for Splunk

  • JDBC URI for the Splunk data source

JDBC URI

When building the URI, include the following components:

  • User

  • Password

  • Port Number

  • Instance URL

  • RTK Key - when you purchase a CData driver from Alation, you are provided an RTK that needs to be included into the URI. If you purchased the driver from CData, you should have a license file that needs to be placed on the Alation server together with the driver .jar file.

Use the following format for the JDBC URI:

splunk://User=<Username_for_splunk>;Password=<Password_for_splunk>;SSLServerCert=*;AuthScheme=Basic; URL= <Instance>:<Port_Number>;RTK=<RTK_Key>

Example:

splunk://User=Admin;Password=Password;SSLServerCert=*;AuthScheme=Basic;URL= https://localhost:8089;RTK=444752465641535552425641454E545042424D333236323900000000000000000000000000000000414C4154494F4E5800005559475655474E4E464242370000

Limitation

Query Log Ingestion is not supported.

Set Up in Alation

Step 1: Add the CData Driver for Splunk to Alation

Depending on how you purchased the CData driver, from Alation or from CData, the driver installation process will be different. Refer to Add the CData Driver into Alation Instance and use the scenario appropriate to your case.

STEP 2: Add a New Datasource

Add a new Datasource on the Sources page.

Step 3: Set up the Connection

  1. On the Add a Data Source screen of the wizard, specify:

    • Database Type: Custom DB

    • JDBC URI: URI in the required format. See ‘JDBC URI’_. Example:

      Marklogic://10.13.64.245;Port=8000;API=REST;User=UserName;Password=Password;UseSSL=True;SSLServerCERT=/tmp/certificate.crt;RTK=444752465641535552425641454E545042424D333236323900000000000000000000000000000000414C4154494F4E5800005559475655474E4E464242370000

    • Select Driver: select the JDBC driver for MarkLogic from the Select Driver drop-down list:

      cdata.jdbc.splunk.SplunkDriver.cdata.jdbc.splunk

    • Do not select the Kerberos ‘Use Kerberos’ checkbox.

  2. Click Save and Continue. The next wizard screen - Set Up a Service Account - will open.

../../_images/Splunk_01.png

Step 4: Enter Service Account Credentials

  1. Select Yes.

  2. Provide the username and password of the service account created for Alation.

  3. Click Save and Continue. The next wizard screen, Configure Your Data Source, will open.

Step 5: Configure Your Data Source

Click Skip this Step. After this step, you are navigated to the Settings page of your data source.

Metadata Extraction

Configure and perform metadata extraction and verify the results:

  • In Settings > Custom Settings, set the Catalog Object Definition to Catalog.Schema.Table:

    ../../_images/Splunk_02.png

  • In Settings > Metadata Extraction, set up and perform MDE. Refer to Metadata Extraction.

Profiling

Configure and perform Sampling and Profiling :

  • Users can run a sample for an individual table on the Samples tab of the Table Catalog page or profile an individual column on the Overview tab of the Column page.

  • Automatic full and selective Profiling is supported.

  • Use the Per-Object Parameters tab of the Settings to specify which objects to profile.

    Note

    Make sure that the Skip Views checkbox of the respective schemas is unchecked to perform the Profiling.

  • Custom query-based Sampling is supported. Custom Query-Based Sampling allows you to provide a custom query for profiling each specific table.

  • Deep Column Profiling (Profiling V2 ) is supported.

Query Log Ingestion

Not supported.

Compose

Log into Compose:

  • Authenticate compose with your Splunk credentials.

  • Use the Catalog.Schema.Table format for writing queries.

Troubleshooting

Logs to collect/review:

  • For logs related to MDE: taskserver.log, taskserver_err.log.

  • For logs related to Compose: connector.log, connector_err.log.

  • For any other errors: alation-error.log, alation-debug.log