Hi guys!
We’re trying to export data from Splunk over to Tableau over ODBC.
We’ve successfully managed to export/import data from two platforms (CallManager/Linux and TMS/Windows), but on 3 other platforms (NetBSD) we have hit some rubble.
What seems to be causing us some issues is that in the _raw column that we see in Tableau or for that matter Excel, some of the data are enclosed with quotation marks such as below:
2015-08-07T08:16:25+00:00 vcs-aer-202 UTCTime="2015-08-07 06:16:25,678" Module="network.tcp" Level="ERROR": Src-ip="173.38.197.xx" Src-port="33872" Dst-ip="10.160.86.xxx" Dst-port="56960" Detail="TCP Connection Failed"
On the successful platforms (the CallManagers and the TMS), we do not see these quotation marks and the import into Tableau functions 100%.
On the NetBSD platforms the coders have decided to use double quotation marks around some events, and that's seems to be the only difference as far as we can see (yeah, I know it's not much to go on but it's still the only difference open to the eye...).
Is there any way to clean up the data before I export to Tableau in my Splunk search that gets sent over to Tableau, as in getting rid of these Quotation marks? I have seen various techniques in the export itself (be it Excel or other csv reader) but that option isn't open to us in Tableau. On the unsuccessful Tableau imports from the NetBSD platform we get the following:
"Unable to create extract".
"StarExtractTupleSource has wrong number of bindings for number of inputs column"
Does anyone have some good tips on this one?
Thanks!
... View more