Getting Data In

SPLUNK Tableau no data

gauravmishra15
Path Finder

Hi Friends,

I am using Tableau to connect to SPLUNK saved searches. I am using ODBC driver Tableau 9.1 for this connection. However Tableau user is able to authenticate against SPLUNK but no data is being displayed.

Initially I thought it is an account or permission issue but I tried admin account but no luck. Did anyone else face the similar issue with tableau ?

Any suggestion is highly appreciated !

Tags (2)

citaliano
Engager

I am able to connect to splunk from Tableau without issue. I'm able to see the saves searches but am not able to see the results of the searches. I am able to see the results of the searches from the web interface, so it doesn't appear to be a permissions issue. Has anyone solved this?

0 Karma

luna23
Explorer

I have the same problem with Tableau 10.
The connexion is working but there is not data at all

0 Karma

citaliano
Engager

were you able to find an answer?

0 Karma

yoshimat
New Member

I have same issue.
Tableau 9.0
Splunk ODBC 2.1.0
Splunk 6.4

0 Karma

acharlieh
Influencer

Not sure if it's related, but something we ran into, is that the Splunk ODBC driver seems to really want to use SSLv3, but due to POODLE, our load balancers had SSLv3 disabled. (It looked like Tableau had connected successfully with no data returned, but turning on tracing for ODBC we were able to see messages like: "[Splunk]SplunkODBC Error with HTTP API, error code: SSL connect error" (and Wireshark was able to tell us what was going on).

For a temporary workaround, I configured a reverse proxy on my local machine to perform the SSLv3 negotiation with SplunkODBC, but the forward on the HTTP requests to the Splunk API (which used TLS). But in the meantime I'm logging a ticket with Splunk to figure out how to configure this with the ODBC driver.

Case: 334302

Update from Splunk Support:

This is a known issue DVPL-6794: ODBC driver needs TLS 1.2 support
No time frame for the fix yet.

hkosuru
Explorer

@acharlieh, thanks for your reply. I turned on tracing for ODBC and I noticed the same error. Please let me know if you get any response for your ticket.

0 Karma

hkosuru
Explorer

@acharlieh, How did you configure reverse proxy? Did you do this on Windows? Thanks!

0 Karma

acharlieh
Influencer

Yes this was on Windows. As my work has a license and I'm familiar with it, I personally used Charles Proxy, a Java based HTTP recording proxy, to pull the man-in-the-middle attack on myself to get things to work.

After installing Charles Proxy, you probably want to disable it from automatically starting Windows and Firefox proxies through Proxy > Proxy Settings > {Windows, Mozilla Firefox} preference panels to uncheck the "Enable at startup" flags.

Then you add a Reverse Proxy in Proxy > Reverse Proxies, ensure "Enable Reverse Proxies" is checked, then click "Add", pick an arbitrary local port, use (your load balancer host) as the remote host, and (your load balancer Splunk API port) as the remote port. Ensure that "Preserve Host Header" is not checked and click OK.

Then you enable SSL Proxying in Proxy > SSL Proxying, check the box to enable SSL Proxying, and add a Location of (your load balancer host).

Finally with Charles Proxy running, Launch Tableau... Instead of using https://(your load balancer host) you then use https://localhost and specify the arbitrary local port that you picked above when setting up the reverse proxy, and use your same Splunk username and password.

As it is essentially a MITM attack on yourself, you would not want to put this workaround in place for everyone as it's decrypting and re-encrypting all of the HTTPS traffic, but on your local machine for your own traffic that should be ok until you discuss with load balancer teams if enabling SSLv3 is an option or Splunk gets back to us.

hkosuru
Explorer

I am running into the same problem. I am using Tableau 9.2, Splunk ODBC 2.0 & Splunk 6.2. I checked the logs. No exceptions or anything.

I can see the saved searches in the browser. https://splunk.xxxxx.com:8089/services/saved/searches.
Tableau is connected to Splunk but I don't see any data in Tableau.

Anyone solved this problem? Thanks!

0 Karma

gflynn
Explorer

Check the Tableau log files at C:/Users/[your user]/Documents/My Tableau Repository/Logs. I haven't resolved my issue, but the logs are helping understand what's happening.

0 Karma

gauravmishra15
Path Finder

SPLUNK authentication from Tableau works fine. I've created couple of savedsearch in global search application and custom applications, tableau does not display either of them.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...