The new integration between Tableau
software and Splunk means accessing
machine generated data from things like
web servers or RFID devices is easier
than it has ever been. Let's
explore. Let's say I'm a Splunk admin
and the company I work
for is an online retailer and we sell
things like mobile device accessories.
The business is really eager to know if
there are customers that are putting
things into their carts on our online
shopping site and then taking them out
for some reason. So, what I've done as
the Splunk administrator is look at
those web server logs and access that
information and built a saved search
that allows me to generate every time
that happens. I can even look at that
over time just a little bit inside of
Splunk. But I've got that save search
and that's got all the relevant
information that the business has asked
for. And so I'm going to hand it off to
them and let them do additional analysis
since I know that they may have
additional sales data or maybe it's
Google Analytics data or other types of
assets inside the company they may want
to compare it with. My job is done. I'm
going to change rules now and become
that business unit analyst, right? Or
somebody in charge of crunching those
numbers. And thanks to my Splunk
administrator, I've been told just go
ahead connect straight up to Splunk
using the following
credentials. And what will happen is
Tableau Desktop will reach out to our
Splunk instance and connect directly and
we'll have access to all of those saved
searches that have been created.
Specifically, the one he's built for me,
products removed from basket last 72
hours. Perfect. Click okay. And
Tableau's going to give me the choice
now. Do I want to connect live or do I
want to extract that data? And I'm going
to go ahead and connect live. And boom.
In just a couple clicks, all of that
data built out in that save search by my
Splunk admin is right here, ready for me
to drag and drop and do analysis on
inside of Tableau Desktop. So there are
all the products. There's all the mobile
phone accessories. And then let's look
at the total number of removed events
over the last couple days. And I'll sort
this and put some labels on it. So we
can see here the d the various items and
the total number of
removals. More importantly, this is
interesting to me because I also have
some sales data for these items right
here in Excel. And I want to do a little
data mashup, if you will. And so if that
data, let's say, is just sitting as a
flat file right on my desktop, I can do
something as simple as just drag it
right in and connect live inside of
Tableau because I have product name in
one data source and product name in the
other. That allows me to just take this
data for sales, drag it right in, and
suddenly I'm looking at both data sets
at the same time. And this is pretty
interesting to me, right? I've got a
really high selling item here that's
also got a decent amount of removes. Yet
some of these other ones, maybe the
sales aren't as high, but yet even more
removes. This is another angle for me to
approach our online business and
understand how are customers interacting
with these, right? Is there something
like a product review that is
influencing why people are taking these
out of their cart? What's happening? You
know, the basis for more investigation.
Something else I can do is maybe if I
wanted to view this over time, I might
say, let's look at all of these
removals. And let's go ahead and see if
we can't crack that down. What does that
look like from a time trend standpoint?
And then if I want to kind of put these
two analyses together and say, okay, I
want all of my products, and this
includes both data sets, the Splunk data
looking at total removals from like web
servers and that sales data from
Excel, and then that time trend up top.
And then I really want to be able to dig
in between the two of them. Let's say I
just want to look at a certain chunk of
data from right here. I have the ability
to quickly and easily with a couple
clicks of my mouse, right? have this
visualization that I've built, this time
trend, talk back to this little bar
chart, so that I can start to answer
questions really, really rapidly. And I
can further customize by doing things
like building a little filter here. If I
wanted to filter out certain products,
right, I can easily and quickly do that.
Not a
problem. At the end of the day though,
in just a couple minutes, thanks to the
integration between Tableau and Splunk,
I've connected up to data that I never
had access to before, was able to
combine it with data assets I already
had in house, and quickly and easily
find new revelations and insights about
my business. I can quickly share this
printed as a PDF, an image, shared up to
Tableau Server. I securely let people
log into a web browser and view all of
this analysis. And at the end of the
day, I have not had to touch a piece of
I have not had to write any code. I've
been able to answer the questions that
are important to my business and further
innovation.
The integration between Tableau and
Splunk means that machineerated data
that has been previously locked away and
unaccessible to anybody inside of a
business unit is now as simple as
connecting directly to a Splunk
instance, opening a Tableau desktop and
driving insight.