1 Reply Latest reply on Dec 16, 2016 4:59 AM by lenaic.ridinger

    Combing Splunk Data sources

    Tyler Straub


      We have a different splunk instance for each customer, each with the exact same reports.  We cannot combine the data sources before they get into Tableau.  The end goal is to have one Tableau Desktop with a live connection to each splunk instance, and a dropdown which allows the user to select the customer (via parameter) and have all charts update per the data from the customers splunk.  The user will also needs the ability to filter the data in each chart via set quick filters from common fields from each customer ***** instance.  This means when customer X is selected the quick filter will populate with only that customers data for site (for instance) and they can filter from there.  I have it setup now where I have a calculated field in each connection which filters out the data if the customer is not selected, returning 0 records for unselected customers, and the full data set for the selected customer.    Is there a way to combine the data to fit this need?  I was thinking about a coalesce or concatenate funciton, but nothing seems to work so far.  I am running tableau desktop 10.1.1