Why your Tableau Server needs Splunk

Do you administrate an installation of Tableau Server? Do you get questions from your users like:

• I got an error, what caused it? Oh and now I can't reproduce it and no I didn't get a screen shot.
• When did someone last login and interact with my dashboard?
• How many concurrent users do we have on our Tableau Server?
• Is there a better way of monitoring extract refresh failures that doesn't rely on me logging in to the server to check it?

Yes we can answer some of these questions by manually going to either our Tableau Server admin views, or laboriously scouring through log files in multiple locations on our server. But wouldn't it be nice if we stored all this information in one database that had a really powerful text search? Wouldn't it be even better if the users could answer these questions themselves because you had some awesome custom admin views published to your Tableau Server based on data in the logs?This blog is a guide on how to leverage the power of Splunk, set up a forwarder from your Tableau Server to push the log files to Splunk, and then connect to the data in Tableau Desktop to create some great admin views.What is Splunk? Splunk turns machine data in to insight. It can give you real-time understanding of what's happening across your IT systems, Tableau Server included. It's outside the scope of this blog to guide you through setting up an instance of Splunk, but you can find out some more information about the Enterprise version here. If you want to try it out there is a 60 day trial available.

Step 1: Setting up a Splunk Receiver for your Tableau Server

Log in to your Splunk server via the web interface. From the menu select Settings and then Forwarding and receiving.Set up a new Receiver:Pop in a free port - the default is 9997, which is what I used.

Step 2: Getting your Tableau Server data in to Splunk

Tableau Server logs record every user interaction, extract refresh, VizQL query and more. Imagine if we could easily search this wealth of information to really see what Tableau Server is doing behind the scenes? How useful would that be to your IT department and Tableau Server administrators?Now, you're going to want to get all your Tableau Server logs stored in your awesome Splunk database first. Ideally Splunk and Tableau Server are on different boxes. So we'll need to install the Splunk forwarder on to the Tableau Server box.We're running our Tableau Server on Windows Server 2012. So I downloaded the Universal Forwarder for that OS, but you can choose the Forwarder for your OS. Once downloaded, run the installation.Now you'll only need add either a Deployment server or a Receiving indexer. I used the Receiving indexer we set up in the previous step.

Step 3: Use the forwarder to push Tableau Logs to Splunk

I'm going to use the Command Line Interface of Splunk to set up the forwarding of the Tableau Server logs to Splunk.On your Tableau Server, open Command Prompt as an Administrator. Then navigate to the Splunk folder using the command: cd 'C:Program FilesSplunkUniversalForwarderbin' (if you've installed to the default location).After that we can add the command to forward the Tableau Log files. The log files are stored in a few different locations, so we'll run a 'add monitor' command for all the locations we want. The command looks a bit like:

splunk add monitor '<directory path>'

The directories I've added to Splunk for our Tableau Server include:<install directory>Program FilesTableauTableau Serverlogs - This is the location of the tabadmin, tabconfig and licencing logs amongst others<install directory>Program FilesTableauTableau Serverdatatabsvclogs - This is the location of the logs of specific processes<install directory>Program FilesTableauTableau Serverdatatabsvcvizqlserverlogs - This is the location of the vizql process logs

Step 4: Using Splunk's powerful search to glean insight from the logs:

This quick video shows you how to use Splunk's search engine to diagnose Tableau Server and answer questions.That's it for this particular blog post, but watch out for more on how to use Splunk with Tableau coming soon.