Documentation Plugins SAP HANA data source Configure

Configure the SAP HANA data source

This document provides guidance on configuring the SAP HANA data source.

Before you begin

The SAP HANA data source has the following requirements.

Grafana requirements:

• Grafana version 11.6.7 or later.
• One of the following:
  • Grafana Cloud Free, Pro, or Advanced account.
  • Grafana Enterprise with an activated license.
• The Organization administrator role to add data sources.

SAP HANA requirements:

• SAP HANA URL, username, and password, along with the necessary permissions.
• Connectivity between the Grafana server and your SAP HANA server. If the connection is protected by firewall rules, you need to allow the Grafana IP address to connect.

Add the SAP HANA data source

For general information on adding a data source, refer to Add a data source.

Complete the following steps to add a new SAP HANA data source:

1. Click Connections in the left-side menu.
2. Click Add new connection.
3. Type SAP HANA in the search bar.
4. Select the SAP HANA data source.
5. Click Add new data source in the upper right.

Grafana takes you to the Settings tab, where you set up your SAP HANA configuration.

Configure the data source in the UI

At the top of the settings page, set the standard Grafana fields:

• Name: The data source name. This is how you refer to the data source in panels and queries.
• Default: Toggle to select this data source as the default in dashboard panels.

The SAP HANA settings are grouped into the same sections you see in the UI: HTTP, Auth, TLS / SSL Settings, Tenant Properties, and Additional Properties.

HTTP

Configure how Grafana reaches your SAP HANA instance.

Auth

Provide the credentials Grafana uses to authenticate.

TLS / SSL settings

TLS is enabled by default. When TLS is enabled, the additional TLS options appear. Disabling TLS hides and resets these options.

When TLS Client Auth is enabled, Client Cert and Client Key fields appear. When With CA Cert is enabled, a CA Cert field appears. Provide each certificate in PEM format.

Tenant Properties

Use these settings to connect to a tenant database. You can connect either by host and port, or by providing a tenant database name and instance number instead of a port.

Additional Properties

Configure optional query and connection behavior.

Secure Socks Proxy

Enable the Secure Socks Proxy option to proxy the data source connection through a secure socks proxy to a different network. For more information, refer to Configure a data source connection proxy.

Find the right port to connect

When creating the data source configuration, you need to specify the correct port number of the SAP HANA instance.

• For SAP HANA Cloud instances, the port is typically 443.
• For on-premises or multi-tenant instances, you can find the respective port number by following the guidance in the SAP HANA documentation.

You can determine the ports used by a particular tenant database by querying the M_SERVICES system view, either from the tenant database itself or from the system database.

From the tenant database:

SQL Copy

SELECT SERVICE_NAME, PORT, SQL_PORT, (PORT + 2) HTTP_PORT FROM SYS.M_SERVICES WHERE ((SERVICE_NAME='indexserver' and COORDINATOR_TYPE= 'MASTER') or (SERVICE_NAME='xsengine'))

From the system database:

SQL Copy

SELECT DATABASE_NAME, SERVICE_NAME, PORT, SQL_PORT, (PORT + 2) HTTP_PORT FROM SYS_DATABASES.M_SERVICES WHERE DATABASE_NAME='<DBNAME>' and ((SERVICE_NAME='indexserver' and COORDINATOR_TYPE= 'MASTER') or (SERVICE_NAME='xsengine'))

Verify the connection

Click Save & test to verify the connection settings and user credentials. A “Data source is working” message indicates that Grafana can connect to your SAP HANA instance. If you don’t see this message, refer to Troubleshooting for help resolving common issues.

Access and permissions

To connect Grafana to SAP HANA, use dedicated credentials and only provide the required permissions to the user.

Create a restricted user

Create a restricted user with username and password. The following query creates a restricted user and disables the force password change:

SQL Copy

CREATE RESTRICTED USER <USER> PASSWORD <PASSWORD> NO FORCE_FIRST_PASSWORD_CHANGE;

Enable client connect

Allow the user to connect to the system through clients such as Grafana:

SQL Copy

ALTER USER <USER> ENABLE CLIENT CONNECT;

Grant permissions

Give the user access to necessary views, tables, and schemas:

SQL Copy

ALTER USER <USER> GRANT ROLE PUBLIC;
GRANT SELECT ON SCHEMA <SCHEMA> TO <USER>;

Data source permissions

Limit access to SAP HANA data by clicking on the Permissions tab in the data source configuration page to enable data source permissions. On the permissions page, admins can enable permissions and restrict query permissions to specific users and teams.

Provision the data source

You can define and configure the data source in YAML files as part of the Grafana provisioning system. For more information about provisioning and available configuration options, refer to Provision Grafana.

YAML Copy

apiVersion: 1
datasources:
  - name: SAP HANA
    type: grafana-saphana-datasource
    uid: sap_hana
    access: proxy
    orgId: 1
    jsonData:
      server: xxxxxx-xxxxxx-xxxxxx-xxxxxx-xxxxxx.hana.trial-us10.hanacloud.ondemand.com
      port: 443
      username: GRAFANA_HANA_USERNAME
      # tlsDisabled: false  # TLS is enabled by default. Set to true only for plaintext (non-TLS) HANA instances.
      tlsSkipVerify: false
      tlsAuth: false
      tlsAuthWithCACert: false
      defaultSchema: EXAMPLE
      # databaseName and instance are for tenant databases. When both are set, the
      # connection uses port 3<instance>13 (for example, 30113) and the port above is ignored.
      # databaseName: DATABASE
      # instance: "01"
      timeout: "30" # Must be a quoted string. An unquoted number fails with "could not parse json".
    secureJsonData:
      password: $SECURE_HANA_PASSWORD_FROM_ENVIRONMENT_VAR
      tlsCACert:
      tlsClientCert:
      tlsClientKey:
    version: 1
    editable: false

Provision with Terraform

You can configure the SAP HANA data source as code using the Grafana Terraform provider. This approach enables version-controlled, reproducible data source configurations across environments.

terraform Copy

terraform {
  required_providers {
    grafana = {
      source  = "grafana/grafana"
      version = "~> 3.0"
    }
  }
}

provider "grafana" {
  url  = var.grafana_url
  auth = var.grafana_auth
}

resource "grafana_data_source" "sap_hana" {
  type = "grafana-saphana-datasource"
  name = "SAP HANA"

  json_data_encoded = jsonencode({
    server        = var.sap_hana_server
    port          = var.sap_hana_port
    username      = var.sap_hana_username
    defaultSchema = var.sap_hana_default_schema
    # When databaseName and instance are both set, the connection uses port
    # 3<instance>13 and the port above is ignored. Leave them empty to use the port.
    databaseName  = var.sap_hana_database_name
    instance      = var.sap_hana_instance
    # If you add a timeout, pass it as a quoted string (for example, "30"). An
    # unquoted number fails with "could not parse json".
    # tlsDisabled = false  # TLS is enabled by default. Set to true only for plaintext (non-TLS) HANA instances.
    tlsSkipVerify = false
    tlsAuth       = false
    tlsAuthWithCACert = false
  })

  secure_json_data_encoded = jsonencode({
    password = var.sap_hana_password
  })
}

# Variables
variable "grafana_url" {
  description = "Grafana instance URL"
  type        = string
  default     = "http://localhost:3000"
}

variable "grafana_auth" {
  description = "Grafana authentication (for example, admin:password or API key)"
  type        = string
  sensitive   = true
}

variable "sap_hana_server" {
  description = "SAP HANA server address"
  type        = string
}

variable "sap_hana_port" {
  description = "SAP HANA server port"
  type        = number
  default     = 443
}

variable "sap_hana_username" {
  description = "SAP HANA username"
  type        = string
}

variable "sap_hana_password" {
  description = "SAP HANA password"
  type        = string
  sensitive   = true
}

variable "sap_hana_default_schema" {
  description = "Default schema to use"
  type        = string
  default     = ""
}

variable "sap_hana_database_name" {
  description = "Database name for tenant databases"
  type        = string
  default     = ""
}

variable "sap_hana_instance" {
  description = "Instance number for tenant databases"
  type        = string
  default     = ""
}

# Outputs
output "sap_hana_uid" {
  description = "UID of the SAP HANA data source"
  value       = grafana_data_source.sap_hana.uid
}

Next steps

After configuring the SAP HANA data source, you can:

• Create queries using the SAP HANA query editor
• Set up template variables for dynamic dashboards
• Add annotations to overlay events on your graphs
• Configure alerting to monitor your SAP HANA data