Connect Dremio

Give Halo a Dremio user or personal access token and your Arrow Flight address, test it, and run discovery.

Connect Dremio and Halo reads its spaces and sources as schemas. You'll have a connection, and discovery will map what's in it.

Before you start

In Dremio: someone who can create a user, grant it access and make a personal access token. If that's your IT team, send them this page and Allowlists, SSH tunnels and read-only logins.
In Halo: permission to manage connections, which Owners, Admins and Builders have by default. See Roles and permissions.

Create a read-only user

Make a user for Halo that can run SELECT on the spaces and sources it should see, and nothing else. How you grant that depends on your Dremio edition, so follow Dremio's documentation.

Network

Halo talks to Dremio over Arrow Flight SQL, on its own port: 32010 unless you changed it, not the port of Dremio's web console. That port has to be reachable from Halo's servers.

A Dremio reachable only inside a private network can connect through a bastion host, under SSH tunnel in the connection's settings. See SSH tunnels.

Add the connection

Open Data, then New connection, and choose Dremio.
Under Details, give it a Name and choose a Workspace.

Fill in Connection settings:

Setting	What to enter
Host	Your Dremio coordinator, without the port
Arrow Flight port	32010 unless yours differs
User	The user you made. Leave it empty to sign in with a personal access token alone
Password or personal access token	Either one. It's encrypted and never shown again
TLS	`verify` encrypts and checks the server's certificate, and is the default. `no-verify` encrypts without checking it. For an internal certificate authority, add it under TLS certificates and keep `verify`. Don't use `disable` outside a private network
Spaces and sources	Optional. Spaces, sources or folders to include, each its own, such as `analytics` and `warehouse.sales`. All of them otherwise

Test it

Choose Test connection. You'll see Connected and Dremio's version, or Couldn't connect with the error.

What you see	What to check
A timeout, or the connection refused	The host, that it's the Arrow Flight port, and your firewall
A sign-in error	The user and password, or that the token hasn't expired
A TLS or certificate error	The TLS setting, against what your server offers, and any CA certificates
"confirm the bastion's host key before Halo connects through it"	Compare the fingerprint it shows, then choose Trust this key. See SSH tunnels

Save and discover

Choose Save and discover. Discovery reads tables and columns from Dremio's INFORMATION_SCHEMA, where a schema is a whole path, such as warehouse.sales. Dremio doesn't declare keys or sizes, so discovery infers relationships from the data and its profiles count the rows. A table's reflections show in its description.

If it finishes with No tables found, the user can't see any spaces or sources. Grant it access, and choose Run discovery again.

From there it works like any other source: datasets, calculated fields, extracts and row policies work the same way.

Change the password or token later

Make a new personal access token or change the password in Dremio. A token that expires stops working, so change it before then.
In Halo, open the connection's Settings tab, enter the new one, and save.
Choose Test connection on the connection's page.

What Halo stores, and how it's encrypted, is in What Halo stores.