About Federated Search for Snowflake

Federated Search for Snowflake lets you run federated searches from your Splunk Cloud Platform deployment over federated datasets located in Snowflake tables and views.

Federated Search for Snowflake lets you run federated searches from your Splunk Cloud Platform deployment over federated datasets located in Snowflake tables and views. When you run these federated searches, you use familiar SPL2 search commands and syntax.

Connections and datasets

To set up your Federated Search for Snowflake experience, you must go to Catalog, where you'll define connections and datasets for your Snowflake data store.
Connection
A Snowflake connection defines how Splunk software securely authenticates a link between a Splunk deployment and one or more Snowflake datasets that belong to a specific Snowflake warehouse, database, and schema. This authentication is facilitated through a programmatic access token (PAT). See Connections in Discover Data Using the Catalog.
Dataset
A Snowflake federated dataset is defined by a Snowflake table or view. It must be a table or view that belongs to the Snowflake warehouse, database, and schema identified in the definition of the Snowflake connection with which the dataset is associated. Each federated dataset must be associated with a single connection. A connection can be associated with multiple federated datasets. See Datasets in Discover Data Using the Catalog.

What you need to get started

To get started with federated search of Snowflake data, you must have the following things:

  • You must have a Splunk Cloud Platform (SCP) deployment on AWS (Amazon Web Services).

  • Your SCP deployment user account must have a role with the edit_connections or edit_datasets capabilities. See Define roles on the Splunk platform with capabilities in the Splunk Cloud Platform Manage Users and Security manual.

  • You must have a Snowflake environment. Federated Search for Snowflake works with Snowflake environments in any AWS, Microsoft Azure, or Google Cloud Platform (GCP) cloud region.
    Note: For optimal performance, ensure that your Snowflake environment is deployed in the same AWS cloud region as your Splunk Cloud Platform deployment.

  • You must set up a number of items in your Snowflake environment to prepare it for federated search, with the ultimate goal of creating a Snowflake service user that can generate a programmatic access token (PAT). You use the PAT to authenticate federated search access to a Snowflake dataset. For more information, see Create a Snowflake connection.

Getting started checklist

The following checklist guides you through the cross-account setup of Federated Search for Snowflake.

Step Task Description
1 Create a Snowflake connection A connection contains the information you need to authenticate the ability to run federated searches over Snowflake datasets from your Splunk platform deployment.
2 Define a Snowflake dataset When combined with a connection, a federated dataset provides the ability to run searches over a specific Snowflake table or view. This table must belong to the Snowflake warehouse, database, and schema identified in the connection for the federated dataset.
3 Give your users role-based access control of federated datasets After you have successfully created a Snowflake federated dataset, give your users role-based access to it.
4 Write and run federated searches over federated datasets with SPL2 Run federated searches over your Snowflake dataset with SPL2.