Connecting Analyst Studio to your database

When you set up a new data connection, you will provide Analyst Studio with the credentials for a user account in your database that Analyst Studio will use to execute queries against the database. The permissions granted to this user account will govern which tables and records members of your Workspace can access when they use that database connection in Analyst Studio.

A best practice is to create (or ask your database admin to create) a new database user specifically to use with Analyst Studio. Grant this new user read-only permission for the schemas and tables you want your Analyst Studio users to be able to query.

Analyst Studio can connect to your database in two ways:

Typically, users are able to connect Analyst Studio to their database directly. There are, however, a few common scenarios in which you will likely need to use Bridge and/or seek the assistance of your network administrator to connect, namely if:

Direct Connect is the simplest way to connect your database to Analyst Studio. You provide Analyst Studio with the necessary credentials, and Analyst Studio’s servers connect directly to your database. Most databases hosted by third parties, such as Amazon, Google, and Segment, are publicly accessible and are compatible with Direct Connect. In some cases, databases hosted in private networks can also be publicly accessible and are compatible with Direct Connect.

In order to use Direct Connect, your database must:

Your database may require you to allowlist Analyst Studio’s IP addresses before it will accept an incoming connection from our servers. All connections from Analyst Studio will come from one of these eight IP addresses:

54.68.30.98/32
54.68.45.3/32
34.209.23.118/32
54.188.241.100/32
52.43.195.103/32
3.224.146.111/32
54.221.238.89/32
52.20.173.236/32

If your database or network environment does not meet the above requirements, consider connecting with Analyst Studio’s Bridge connector instead.

To add a new data connection to your Workspace using Direct Connect:

A database is "publicly accessible" if the server it is hosted on can be reached via any internet connection. Users aren’t required to be logged in to a VPN or on a private network to access the database.

To check if your database is publicly accessible, run the following command on a computer that’s not logged in to your VPN or private network. Replace your_db_host and your_db_port with the host and port of your database:

If the connection succeeds, your database is publicly accessible. If it fails, it likely isn’t.

In some instances, however, the connection can fail because your database doesn’t allow connections from IP addresses that haven’t been added to an allowlist. If this may be the case, find your computer’s IP address and add it to your database’s IP address allowlist. Try the command above again. If it succeeds, your database is publicly accessible and can connect to Analyst Studio directly. Note that you may need to allowlist Analyst Studio’s IP addresses in your database’s configuration.

Although we don’t currently support connecting databases via SSH tunneling, we do offer our Bridge software to connect to a database located on a private network or behind a VPC. You can read more about this process here.

Your database may not be publicly accessible. You can check if your database is publicly accessible by following the steps in this section. If your database isn’t publicly accessible, you should connect using Bridge.

This is a generic MySQL error that indicates Analyst Studio can’t reach your database. There are a couple of common causes for this error:

This is a generic error that indicates Analyst Studio can’t reach your Redshift database. There are a couple of common causes for this error:

This error occurs if you try to connect with a JSON key rather than a P12 key. When completing the last step of setting up your BigQuery connection, double-check that you’re using a P12 key.

This means that your database does not have SSL configured. To ensure your data remains secure, Direct Connect doesn’t support connecting unless your database allows encrypted connections. To enable SSL, please refer to your database’s website for information on how to configure TLS/SSL for your database.

If you don’t want to or can’t enable SSL, you can connect your database to Analyst Studio using Bridge. Though Bridge connections use transport encryption by default, you can disable it by clicking the green "turn off transport encryption" link when setting up Bridge.

"Publicly accessible" databases aren’t databases that can be queried by anyone in the general public—​nearly all "publicly accessible" databases still require passwords and encrypted connections. Instead, "publicly accessible" means that the database can be reached via any internet connection. Users aren’t required to be logged in to a VPN or on a private network to access the database.

The easiest way to check if your databases is publicly accessible is to run the following command on a computer that’s not logged in to your VPN or private network. Replace host and port with the host and port of your database:

If the connection succeeds, your database is publicly accessible. If it fails, it likely isn’t.

In some instances, however, the connection can fail because your database doesn’t allow connections from IP addresses that haven’t been added to an allowlist. If this may be the case, find your computer’s IP address and add it to your database’s IP address allowlist. Try the command above again. If it succeeds, your database is publicly accessible and can connect to Analyst Studio directly, provided that the appropriate IP addresses are allowlisted.

Typically, users will connect Analyst Studio directly to their database. However, there are many situations in which directly connecting Analyst Studio to your database is not possible, or modifying the configuration of your VPN/firewall is not practical or desirable. For these cases, Analyst Studio offers an application ("the Bridge connector") to coordinate communication between Analyst Studio and your databases. The Bridge connector is easy to install, configure, and maintain.

The Bridge connector can run on a computer or virtual machine within your organization’s VPN or firewall. Analyst Studio also supports running the Bridge connector inside a Docker container.

When you write and run a query in Analyst Studio, the Bridge facilitates the connection to your database. The query is executed by your database using the user credentials you provide when setting up Analyst Studio. Once complete, Bridge sends data back to Analyst Studio, so you can visualize and share the results.

To install and configure Bridge, you must have sufficient (typically local administrative) privileges on the host computer. You must also have access within Analyst Studio to connect data sources for your Workspace.

Bridge connects to Analyst Studio by making outbound TCP connections on the following ports:

You can run Analyst Studio’s Bridge connector as a container on any Linux host running Docker engine.

You can also install the Bridge connector on any computer running any of the following supported operating systems:

These instructions assume that you meet the requirements and would like to install Analyst Studio’s Bridge connector on a host computer you administer.

Our system packages will install Bridge and configure the system to run Bridge via the system’s service manager. Bridge’s configuration file 'bridge.json' contains a credential and should be kept secret when incorporating it into configuration management systems.

These instructions assume you meet the requirements and would like to run Analyst Studio’s Bridge connector in a Docker container.

No. A single Bridge connector can support multiple databases.

The Bridge connector provides a tunnel through which Analyst Studio’s platform can connect to your database(s). The connection between the Bridge and Analyst Studio is fully encrypted. The Bridge connector stores only its own configuration. There is no caching or database driver in the Bridge. No database credentials, queries, or query results are stored within the connector.

Some older databases either do not support or have not been configured to support transport encryption. To enable customers to connect Analyst Studio to these databases, we support disabling transport encryption, but only when connecting via the Bridge.

If you disable transport encryption when configuring the Bridge connector, this will disable the encrypted connections between the computer running the Bridge connector and your database. However, all communication between the computer running Bridge and Analyst Studio will still be fully encrypted.

To replace an existing Bridge connection, first remove the existing Bridge from Analyst Studio.

Next, add the new database.

The next page should prompt you to install Bridge. Because you already have Bridge installed, skip to the final step that asks you to run mode-bridge setup. On the machine where you’re running Bridge, add -replace to the command listed and run the entire command. The new command should look like this:

Finally, restart the Bridge application.

Bridge will install in one of the following locations, depending on which operating system the host computer is using. To install and configure Bridge, you must have sufficient (typically local administrative) privileges on the host computer.

You can locate the configuration file using the following OS-specific paths:

The commands to start or stop Bridge vary across operating systems. If you don’t see commands listed for your system below, please contact ThoughtSpot Support.

The token’s secret is a protected string and is not visible in the Analyst Studio UI after initial creation. If the configuration files displayed were not copied or saved somewhere by the user, they should be considered lost forever. We recommend deleting this bridge and creating a new one.

To verify that your Bridge connector has been configured correctly, you can inspect the logs for any error messages by running the following command:

docker logs --tail 30 mode-bridge

If you discover you need to make any corrections to your configuration file, edit the file and then restart your container to apply the changes by running the following command:

docker restart mode-bridge

You may see several error messages that say Bridge could not verify the connection.

This error indicates that Analyst Studio could reach your Bridge connector, but Bridge couldn’t reach your database.

You may see this error if your database credentials are invalid. As a first step, check the credentials and try again. Note that if your database doesn’t have a password, entering any password should fix this error.

If you’re sure the credentials are correct, these errors can also occur when Bridge is installed on a machine that can’t access your database. Importantly, this error occurs from the perspective of the machine running Bridge, not necessarily from your computer or from Analyst Studio’s servers. Most commonly, this error occurs when your database is accessible only to computers inside a VPN. If you installed Bridge on a computer outside your VPN, or if the computer is not currently logged in to the VPN, Bridge won’t be able to connect to your database.

You can test if the machine running Bridge has access to the database by running this command on the machine running Bridge:

If the command succeeds, the computer has access to the database. You can contact ThoughtSpot Support for further assistance.

If the command fails, the computer running Bridge doesn’t have access to the database. To fix this, you should either install Bridge on a machine that has access or adjust your network settings so that the machine running Bridge has access to your database.

This error indicates that Analyst Studio couldn’t reach your Bridge connector.

First, check if Bridge is running with the command listed below.

If Bridge is not running, restart the Bridge application.

If Bridge is running, Analyst Studio may not be able to reach Bridge because the ports that Bridge connects over are closed. Bridge connects to Analyst Studio over outbound port 8444. You can confirm that the port is open for Bridge by running these commands on the computer running Bridge.

If these commands fail, you must open the outbound port on your network and on the computer running Bridge.

If the port is open and you still see this error, your Bridge config file may not match what Bridge is looking for. If you have made manual changes to the config file, either revert your custom changes and try connecting again, or contact ThoughtSpot Support for additional help.

This error typically occurs when you attempt to install Bridge without the proper permissions. To resolve, open an instance of PowerShell with elevated privileges (Run as Administrator) and use that instance to install Bridge.