| Feature | Description | |
|---|---|---|
| Permissions on metadata | Tableau Catalog enables you to control who can see and manage external assets and what metadata is shown through lineage by setting permissions. | |
| Expanded connect experience – data discovery | Whether you author in the web or in Tableau Desktop, you can now search for and connect to the specific databases and tables used by published data sources and workbooks on your Tableau Server or Tableau Cloud site. | |
| Expanded search | Tableau Catalog expands search to include results based on columns, databases and tables. | |
| Tag external assets | You can categorise items on Tableau Server and Tableau Cloud with tags, helping users to filter external assets (databases, files, tables and columns). | |
| Certify databases and tables | Help users find trusted data that meets the standards you set by certifying databases and tables. | |
| Set data quality warnings | You can set warnings to alert users to data quality issues, such as stale or deprecated data. | |
| Lineage and impact analysis | The Lineage tool traces the source of your data. You can use it to analyse the impact of changes to your data, identify which users might be impacted, and email owners of a workbook, data source or flow, or contacts for a database or table, about data-related updates. | |
| Data Details | Enable users to better understand a published visualisation by seeing information about the data used. | |
| Add descriptions to assets | Help users find the data they're looking for by adding descriptions to databases, tables and columns. | |
| Developer resources | Tableau REST API - metadata methods | Programmatically add, update and remove external assets; and add additional metadata to Tableau content and external assets like descriptions. |
| Tableau Metadata API | Programmatically query metadata from the content published to Tableau Server or Tableau Cloud. Programmatically update certain metadata using the metadata methods in the Tableau Server REST API. Note: The Metadata API does not require Data Management. | |
| GraphiQL | Explore and test queries against the Metadata API schema using an interactive in-browser tool called GraphiQL. Note: GraphiQL does not require Data Management. | |
Table A and Table X are unrelated | Table B and Table X are unrelated |
 |  |
Table A and Table S are related | Table B and Table S are related (through Table A) |
 |  |
| Not yet related | Ambiguously related | Relatedness resolved to a single tree | |
| Related through base Table A | Related through base Table X | ||
 |  |  |  |
Stitching | Resolving uncertainty |
 Unrelated FieldA and FieldX stitched by DimensionS | FieldS and FieldT evaluated through the tree defined by base Table A |
| Juxtaposes unrelated fields based on shared attributes | Narrows down which relationship path to use when there are multiple options (ambiguity or a shared measure), or establishes a relationship path when there wasn't one (not yet related). |
Uses multiple base table logic to calculate results | Uses single base table logic to calculate results |
| Analysis involves unrelated tables | Analysis involves shared tables |
Classes | Clubs | Students |
 |  |  |
Fields:
| Fields:
| Fields:
|
| Resolved Issue | Fixed as of |
Extracts Local data source (in a workbook): Attempting to extract a multi-fact relationship data source will give a "No such table" error. Published data source: Extracting a published multi-fact relationship data source appears to succeed, but field values can be swapped. |
If you still see these issues in Tableau Desktop or Tableau Server, upgrade to a version from 24th July 2024 or later. |
EXCLUDE Level of Detail expressions Only INCLUDE LODs should be validated in the presence of unrelated fields. However, EXCLUDE LODs may also be incorrectly marked as not valid in the same conditions. | |
Nested user calculations Nested user calculations are not available in published data sources with a multi-fact relationship data model. |
| Feature | Description |
| Tableau Authoring | Use Tableau Desktop or Tableau web authoring on Tableau Server to create, collaborate and share insights about your data. Tableau provides you with a way to identify and solve problems, or highlight key findings in a visual and easily understandable way. |
| Tableau Prep | Tableau Prep is a data preparation tool for cleaning, shaping and combining data for analysis. |
| eLearning | Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities. |
| About Data Management | Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Server environment. |
| About Tableau Advanced Management on Tableau Server | Advanced Management is a collection of features and capabilities designed to provide enhanced security, manageability and scalability for Tableau Server. |
| Feature | Description |
| Tableau Authoring | Use Tableau Desktop or Tableau web authoring on Tableau Server to create, collaborate and share insights about your data. Tableau provides you with a way to identify and solve problems, or highlight key findings in a visual and easily understandable way. |
| Tableau Prep | Tableau Prep is a data preparation tool for cleaning, shaping and combining data for analysis. |
| eLearning | Role-based training Tableau Learning Paths provide a clear track to proficiency with the most up-to-date Tableau training content. Assessments help you evaluate where you are in your learning path and give you confidence in your new skills. Accelerate the onboarding process for new employees and help more experienced users get the most out of Tableau capabilities. |
| About Data Management | Data Management is a collection of features and capabilities that helps customers manage Tableau content and data assets in their Tableau Server environment. |
| About Tableau Advanced Management on Tableau Server | Advanced Management is a collection of features and capabilities designed to provide enhanced security, manageability and scalability for Tableau Server. |
| Premier Success | The Premier Success Plan helps you start strong, grow your business and get more value from Salesforce with expert guidance and expedited support. |
| Parameters | If the flow includes user parameters, the parameter value last run in the flow is shown and you can see all generated outputs in the Output column. When the flow is run, you'll be prompted to enter the parameter values. System parameters (version 2023.2 and later) are automatically generated at flow run time and the type of system parameter is shown in the Parameters column. To see the last system parameter value applied to the flow, edit the flow. For more information about using parameters in flows, see Create and Use Parameters in Flows in the Tableau Prep help. |
| Status | After a flow has run successfully, outputs that are data sources become links that you can click to open the Data Source page to view more information about the data source or edit the flow input connection. |
| Schedule | In the Schedule field, view the scheduled tasks that the output step is assigned to. A flow output can be assigned to one or more tasks. If no schedule has been assigned yet, click Create new task to add the output step to a schedule. To immediately run the flow to update a specific output step, click the Run |
| Errors | If the flow has errors, the flow run will fail. Connectivity errors can be resolved directly by navigating to the Connections tab for the flow and editing the input connections. To resolve any other flow errors, edit the flow then republish it and try running the flow again. If you are using an earlier version of Tableau Prep Builder, from the More actions |
button on the left-hand side of the row.
menu, you can also download and open the flow in Tableau Prep Builder, then republish it and try running the flow again.| Upgrading From | Upgrading To | Upgrade Method | Next Steps |
|---|---|---|---|
| n/a | Tableau Server versions: 2022.1.0 (and later), 2022.3.0 (and later), 2023.1 (and later) and later | New installation | Go to Step 2. |
| Tableau Server versions: 2022.1-2022.1.7, 2022.3-2022.3.9 or 2023.1-2023.1.5 | Tableau Server versions: 2022.1.8 (and later), 2022.3.10 (and later), 2023.1.6 (and later) and later | n/a | Have you enabled the new schema for sign-in (i.e. |
| Tableau Server versions: 2021.4.x or earlier | Tableau Server versions: 2022.1.8 (and later), 2022.3.10 (and later), 2023.1.6 (and later) and later | n/a | Go to Step 2. |
| Tableau Server versions: 2021.4.x or earlier | Tableau Server versions: 2022.1.0-2022.1.7, 2022.3.0-2022.3.9 or 2023.1.0-2023.1.5 | If you’re performing a Blue/Green upgrade or manually upgrading Tableau Server by 1) installing Tableau Server on a new machine and then 2) backing up and restoring Tableau Server using the tsm maintenance (backup and restore) commands, you’re required to take some additional steps to initiate the migration. | Go to Troubleshoot Issues with the Identity Migration. |
| If you’re doing an “in-place” single-server or multi-node upgrade of Tableau Server using the method described here, there are no additional steps required from you to initiate the migration. The migration initiates after Tableau Server upgrade to version 2022.1 (or later) is complete. | Go to Step 2. | ||
| If you’re manually upgrading Tableau Server by 1) installing Tableau Server on a new machine and then 2) exporting and importing configuration and topology information using tsm settings (export and import) commands, there are also no additional steps required from you to initiate the migration. The migration initiates after the import process completes on the new Tableau Server machine. | Go to Step 2. |
| Scope | Methods enabled |
|---|---|
tableau:datasources:* | Enables create, update and update connection data source methods. |
tableau:metrics:* | Enables query, update and delete metrics actions. |
tableau:workbooks:* | Enables publish, update, download and preview image workbook actions. |
tableau:groups:* | Enables create, query, update and delete groups actions. |
tableau:projects:* | Enables create, delete and update projects methods. |
tableau:users:* | Enables get/list, add, delete and update users methods. |
tableau:tasks:*Note: This scope is also cross-category. | Enables get/list, add, delete, update and run methods for extracts and subscription tasks. Enables update methods for data sources for workbooks. |
| Scope | Methods enabled |
|---|---|
tableau:content:read | Enables read/list methods for Tableau content, including data sources, metrics, views, workbooks, projects and sites. |
tableau:tasks:run | Enables run methods for data sources, workbooks and extracts. |
tableau:views:download | Enables download methods for view data and workbooks. |
tableau:tasks:*Note: This scope is also wildcard. | Enables get/list, add, delete, update and run methods for extracts and subscription tasks. Enables update methods for data sources for workbooks. |
| Generic file name | Server ATR file names | FlexNet file names |
|---|---|---|
| OfflineActivationRequest | OfflineActivationRequestFile_yyyyMMdd.hhmmss.json | TableauOfflineActivationRequest.tlq |
| OfflineActivationResponse | OfflineActivationLicensingAtrs.zip | activation.tlf |
| ATR duration | Authorisation check frequency |
| < 4 hours | every 15 minutes |
| < 24 hours | every 1 hour |
| < 7 days | every 12 hours |
| > 7 days | every 24 hours |
| ATR duration in seconds | Minimum | Maximum | Default |
|---|---|---|---|
| Tableau Server (container) | 3600 (1 hour) | 2593000 (30 days) | 14400 (4 hours) |
| Tableau Server (non-container) | 3600 (1 hour) | 7776000 (90 days) | 432000 (5 days) |
| Attribute Name | Type | Description |
|---|---|---|
| actorUserId | integer | ID of the user who performed the action that initiated the event |
| actorUserLuid | string | LUID of the user who performed the action that initiated the event |
| eventOutcome | string | Represents the final outcome of the operation. Possible values are:
|
| eventOutcomeReason | string | Provides additional details about the event outcome |
| eventProcessedTime | string | Timestamp of when the event was available in Activity Log. This attribute applies to events written after the Hyperforce migration in January and February 2026. To see the timestamp for when the event occurred, use the eventTime attribute. |
| eventTime | string | Timestamp when the event occurred |
| initiatingUserId | integer | ID of the initiating user. This value is usually the same as actorUserId and differs only for delegated authentication, such as trusted tickets or impersonation. During impersonation, it’s the ID of the administrative user who initiated the session. When the session has no initiating user, or no session exists, initiatingUserId uses the value of actorUserId. |
| initiatingUserLuid | string | LUID of the initiating user. For impersonation, it's the LUID of the administrative user who initiated impersonation. For standard login, the value is the same as actorUserLuid. |
| licensingRoleName | string | Name of the user's licensing role when the event occurred |
| serviceName | string | Name of service that initiated the event, such as vizportal, vizqlserver or sitesaml. |
| siteLuid | string | LUID of the Tableau site where the event occurred |
| siteRoleId | integer | The user's site role ID. The value 0 = SiteAdministratorExplorer, 1 = SupportUser, 2 = ExplorerCanPublish, 3 = Explorer, 7 = Guest, 8 = Unlicensed, 9 = Viewer, 10 = Creator, and 11 = SiteAdministratorCreator. |
| systemAdminLevel | integer | Indicates if the user is a system administrator. The value 10 = System Admin and 0 = Not a system admin. |
| Attribute Name | Type | Description |
|---|---|---|
| groupID | integer | The ID of the group |
| groupLuid | string | The LUID of the group |
| groupOperation | string | Group operation, either add or delete user to a group |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| userId | integer | The ID of the user |
| userLuid | string | The LUID of the user |
| Attribute Name | Type | Description |
|---|---|---|
| contentId | integer | The ID of the content that had the owner changed |
| contentLuid | string | LUID of the content that had the owner changed |
| contentName | string | Name of the content that had the owner changed |
| contentType | string | The type of content, such as data source, workbook or view |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| newOwnerId | integer | The ID of the new content owner |
| newOwnerLuid | string | The LUID of the new content owner |
| oldOwnerId | integer | The ID of the old content owner |
| oldOwnerLuid | string | The LUID of the old content owner |
| Attribute Name | Type | Description |
|---|---|---|
| groupDomain | string | The domain of the group, such as local |
| groupID | integer | The ID of the group |
| groupLuid | string | The LUID of the group |
| groupName | string | The name of the group that had its permissions changed |
| groupOperation | string | Group operation, either create or delete |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| Attribute Name | Type | Description |
|---|---|---|
| authorisableType | string | The type of content that had its permissions changed, such as a project or workbook |
| capabilityId | integer | The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete |
| capabilityValue | string | Description of the capability |
| contentId | integer | The ID of the content that had the permissions updated |
| contentLuid | string | The LUID of the content item |
| contentName | string | The name of the content that had the permissions updated |
| granteeId | integer | The ID of the grantee |
| granteeLuid | string | The LUID of the grantee |
| granteeType | string | The type of grantee, either user or group |
| granteeValue | string | The updated permissions value, such as 'user allow' or 'group allow' |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| Attribute Name | Type | Description |
|---|---|---|
| authorisableType | string | The type of content that had its permissions changed, such as a project or workbook |
| contentId | integer | The ID of the content that had the permissions updated |
| contentLuid | string | The LUID of the content |
| contentName | string | The name of the content that had the permissions updated |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| Attribute Name | Type | Description |
|---|---|---|
| authorisableType | string | The type of content that had its permissions changed, such as a project or workbook |
| capabilityId | integer | The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete |
| capabilityValue | string | Description of the capability |
| contentId | integer | The ID of the content that had the permissions updated |
| contentLuid | string | The LUID of the content |
| contentName | string | The name of the content that had the permissions updated |
| granteeId | integer | The ID of the grantee |
| granteeLuid | string | The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The granteeId attribute is always present. |
| granteeType | string | The type of grantee, either user or group |
| granteeValue | string | The updated permissions value, such as 'user allow' or 'group allow' |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| Attribute Name | Type | Description |
|---|---|---|
| granteeId | integer | The ID of the grantee |
| granteeLuid | string | The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The granteeId attribute is always present. |
| granteeType | string | The type of grantee, either user or group |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| Attribute Name | Type | Description |
|---|---|---|
| displayTabs | boolean | Indicates whether sheets of the workbook are displayed as tabs or not |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| workbookId | integer | The ID of the workbook |
| Attribute Name | Type | Description |
|---|---|---|
| contentId | integer | The ID of the content that had the owner changed |
| contentLuid | string | LUID of the content that had the owner changed |
| contentName | string | Name of the content that had the owner changed |
| contentType | string | The type of content, such as data source, workbook or view |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| newContainerLuid | string | LUID of the new container |
| newContainerType | string | The new container type, such as a project |
| oldContainerLuid | string | LUID of the previous container |
| oldContainerType | string | The previous container type, such as a project |
| Attribute Name | Type | Description |
|---|---|---|
| controllingProjectLuid | string | LUID of the project that controls permissions for the nested project |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| projectLuid | string | LUID of the project |
| projectOperation | string | Project operation, either lock or unlock |
| Attribute Name | Type | Description |
|---|---|---|
| authorisableType | string | The type of content that had its permissions changed, such as project or workbook |
| capabilityId | integer | The ID of the capability. A capability is the ability to perform a certain action on a particular piece of content, such as view, filter, download or delete. |
| capabilityValue | string | Description of the capability |
| contentId | integer | The ID of the content that had the permissions set |
| contentLuid | string | The LUID of the content item |
| contentName | string | The name of the content that had the permissions set |
| granteeId | integer | The ID of the grantee |
| granteeLuid | string | The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The granteeId attribute is always present. |
| granteeType | string | The type of grantee, either user or group |
| granteeValue | string | The set permissions value, such as “user allow” or “group allow” |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| permissionType | string | The permission type. A value of explicit means an Allow or Deny rule was set. A value of unspecified means a rule was removed or set to inherited. |
| Attribute Name | Type | Description |
|---|---|---|
| authorisableType | string | The type of content that had its permissions changed, such as a project or workbook |
| capabilityId | integer | The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete |
| capabilityValue | string | Description of the capability |
| contentId | integer | The ID of the content that had the permissions updated |
| contentLuid | string | The LUID of the content |
| contentName | string | The name of the content that had the permissions updated |
| granteeId | integer | The ID of the grantee |
| granteeLuid | string | The LUID of the grantee |
| granteeType | string | The type of grantee, either user or group |
| granteeValue | string | The updated permissions value, such as 'user allow' or 'group allow' |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| permissionType | string | The permission type, either explicit or unspecified |
| Attribute Name | Type | Description |
|---|---|---|
| authorisableType | string | The type of content that had its permissions changed, such as a project or workbook |
| capabilityId | integer | The ID of the capability. A capability is the ability to perform actions on content, such as view, filter, download or delete |
| capabilityValue | string | Description of the capability |
| contentId | integer | The ID of the content that had the permissions updated |
| contentLuid | string | The LUID of the content |
| contentName | string | The name of the content that had the permissions updated |
| granteeId | integer | The ID of the grantee |
| granteeLuid | string | The LUID of the grantee. This value can be null if the grantee was recently deleted or the LUID lookup service is unavailable. The granteeId attribute is always present. |
| granteeType | string | The type of grantee, either user or group |
| granteeValue | string | The updated permissions value, such as 'user allow' or 'group allow' |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| permissionType | string | The permission type. A value of explicit means an Allow or Deny rule was set. A value of unspecified means a rule was removed or set to inherited. |
| templateType | string | The type of permission template used to change permissions, such as workbook or data source |
| Attribute Name | Type | Description |
|---|---|---|
| forUserName | string | The name of the user whose account was either created, updated or deleted |
| isError | boolean | Indicates if the audit scenario was completed successfully or failed with an error |
| siteRole | string | Site role of the user. Determines the maximum level of access a user can have on the site |
| targetUserId | integer | The ID of the user whose account was either created, updated or deleted |
| targetUserLuid | string | The LUID of the user whose account was either created, updated or deleted |
| userOperation | string | The action performed on a user, either create, delete or site role change |
| Product Name | Product Image URL | Product Sales |
| Flats | https://img.example.com/flats.png | 12,118 |
| High Heels | https://img.example.com/highheels.png | 15,865 |
| Running Shoes | https://img.example.com/runningshoes.png | 14,200 |
| Wedges | https://img.example.com/wedges.png | 8,665 |
| Capability | Definition | Notes |
| Add new users | Create and add new users to the site | To be able to add users by importing a file upload, the admin profile must include Manage user settings in addition to Add new users. |
| Manage user settings | Assign site roles and manage user settings | User settings include locale, email address, force password update and so on. May need to be granted on multiple sites.* |
| See users | See what users exist on the site | See users is required for all other user management capabilities in the UI. It isn’t required for the API. |
| Delete users | Permanently remove users |
| Capability | Definition | Notes |
| Create new groups | Create groups with and without grant role on sign-in | |
| See groups | See what groups exist on the site | See groups is required for all other group management capabilities in the UI. It isn’t required for the API. |
| Edit group details | Change group names and grant role on sign-in status. | |
| Add users to groups | Manage group membership | Only users with an admin site role can assign an admin site role to another user. |
| Delete groups | Permanently remove groups |
| Fields excluded by default | Reasons for exclusion |
|---|---|
All unvisualised measures when there are more than 1,000 measures in the data source. All unvisualised dimensions when there are more than 1,000 dimensions in the data source. | Computing explanations for more than 1000 unvisualised measures or dimensions can take longer to compute, sometimes several minutes. These fields are excluded by default for initial analysis, but you can choose to include them for further analysis. In this situation, you might see an alert asking if you want Explain Data to consider more fields. Click the alert link to get more information. Click Explain All to run an analysis that includes more fields. |
| Fields that use geometry, latitude or longitude | Geometry, latitude or longitude by themselves can never be explanations. It is highly likely that an explanation that calls out the latitude or the longitude as an explanation is due to a spurious correlation and not a probable explanation. |
| Dimensions with high cardinality (dimensions with > 500 members) | High cardinality dimensions take longer to compute. Dimensions with more than 500 unique values will not be considered for analysis. |
| Groups, bins or sets | Not currently supported. |
| Table calculations | Table calculations cannot be analysed when table calculations are at a different level of detail than the view. |
| Unvisualised measures that can't be averaged | Unvisualised measures that can't be averaged include measures that are calculated fields where the calculation expression includes aggregations (display as AGG() fields when added to the sheet). |
| Discrete measures and continuous dimensions | Not currently supported. |
| Hidden fields | Not available. |
| Calculated fields with errors | No values present to analyse. |
Identity Store | Authentication Mechanism | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Basic | SAML | Site SAML | Kerberos | (Windows only) Automatic Logon (Microsoft SSPI) | OpenID Connect | Connected Apps | Trusted Auth | Mutual SSL | |
| Local | X | X | X | X | X | X | X | ||
| Active Directory | X | X | X | X | X | X | X | ||
| LDAP | X | X | X | X | X | ||||
| Connected Apps | Trusted Authentication | Server-wide SAML | Site SAML | Kerberos | (Windows only) Automatic Logon (Microsoft SSPI) | Mutual SSL | OpenID Connect | |
| Tableau Connected Apps | N/A | X | X | X | X | X | ||
| Trusted Authentication | N/A | X | X | X | X | X | ||
| Server-wide SAML | X | X | N/A | X | ||||
| Site SAML | X | X | X | N/A | ||||
| Kerberos | X | X | N/A | |||||
| Automatic Logon (Microsoft SSPI) | N/A | |||||||
| Mutual SSL | X | X | N/A | |||||
| OpenID Connect | X | X | N/A | |||||
| Personal Access Token (PAT) | * | * | * | * | * | * | * | * |
Clients | Authentication Mechanism | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Basic | SAML | Site SAML | Kerberos | (Windows only) Automatic Logon (Microsoft SSPI) | OpenID Connect | Connected Apps | Trusted Auth | Mutual SSL | Personal Access Token (PAT) | |
| Tableau Desktop | X | X | X | X | X | X | X | |||
Tableau Prep Builder | X | X | X | X | X | X | X | |||
| Tableau Mobile | X | X | X | X (iOS only *) | X ** | X | X | |||
| Web Browsers | X | X | X | X | X | X | X *** | X | X | |
Clients | Authentication Mechanism | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Basic | SAML | Site SAML | Kerberos | (Windows only) Automatic Logon (Microsoft SSPI) | OpenID Connect | Connected Apps | Trusted Auth | Mutual SSL | Personal Access Token (PAT) | |
| REST API | X | X | X | |||||||
| tabcmd 2.0 | X | X | ||||||||
| tabcmd | X | |||||||||
| Repository | File Store | Controller | Disk Space Required |
|---|---|---|---|
 | 3x repository data + 250 MB To obtain an estimate of the repository data, check the size of To obtain the exact size of the repository data, open the backup file and use the size of the workgroup.pg_dump file. | ||
| 1.5x file store data To obtain an estimate of file store data (extracts, flows, etc.), check the size of | ||
| 3x repository data + 250 MB + 2.5x file store data | ||
| | 3x repository data + 250 MB + 1.5x file store data | |
| | 3x repository data + 250 MB + 1.5x file store data | |
| | 3x repository data + 250 MB + 2.5x file store data | |
| | | 3x repository data + 250 MB + 1.5x file store data |
| Icon | Description |
|---|---|
 | Error – Server was unable to complete the task. |
 | Success – Server completed the task. |
| Icon | Description |
|---|---|
| Error – Server was unable to complete the task. |
| Success – Server completed the task. |
| Repository | File Store | Controller | Disk Space Required |
|---|---|---|---|
| 3x repository data + 250 MB To obtain an estimate of the repository data, check the size of To obtain the exact size of the repository data, open the backup file and use the size of the workgroup.pg_dump file. | ||
| 1.5x file store data To obtain an estimate of file store data (extracts, flows, etc.), check the size of | ||
| 3x repository data + 250 MB + 2.5x file store data | ||
| | 3x repository data + 250 MB + 1.5x file store data | |
| | 3x repository data + 250 MB + 1.5x file store data | |
| | 3x repository data + 250 MB + 2.5x file store data | |
| | | 3x repository data + 250 MB + 1.5x file store data |
Install Type | Processor | CPU | RAM | Free Disk Space |
|---|---|---|---|---|
Single node |
| 8 cores (16 vCPUs), 2.0 GHz or higher | Version 2022.3 and later:
Version 2021.4.0 to version 2022.1.x:
Version 2021.3.x and earlier:
| 50 GB |
| If you are adding Tableau Prep Conductor to your Tableau Server installation, we recommend you add a second node and dedicate this to running Tableau Server Prep Conductor. This node should have a minimum of 4 cores (8 vCPUs) and 16 GB of RAM. | ||||
| Recommended swap memory: The square root of the system RAM or 8 GB, whichever is larger. | ||||
Multi-node and enterprise deployments | Contact Tableau for technical guidance. Nodes must meet or exceed the minimum hardware recommendations, except:
| |||
| 2023.1.8+ | 2023.3.0 | 2023.3.1 - 2024.2.11 | 2024.2.12+ | 2025.1.X – 2025.3.0 | 2025.3.1+ | 2026.2.x | |
|---|---|---|---|---|---|---|---|
| AlmaLinux 8.x | | | | | | ||
| AlmaLinux 9.x | | | | | | ||
| AlmaLinux 10.x | | ||||||
| Amazon Linux 2 | | | | | |||
| Amazon Linux 2023 | | | | | | ||
| CentOS 7.9+ (not 8.x) | | | | | |||
| CentOS Stream 8.x | | | | | | ||
| CentOS Stream 9.x | | | | | | ||
| CentOS Stream 10.x | | ||||||
| Oracle Linux 7.3+ | | | | | |||
| Oracle Linux 8.x | | | | | | ||
| Oracle Linux 9.x | | | | | | ||
| Oracle Linux 10.x | | ||||||
| RHEL 7.3+ | | | | | |||
| RHEL 8.3+ | | | | | | | |
| RHEL 9.x | | | | | | | |
| RHEL 10.x | | | |||||
| Rocky Linux 8.x | | | | | | ||
| Rocky Linux 9.x | | | | | | ||
| Rocky Linux 10.x | | ||||||
| Ubuntu 16.04 LTS | | | | | |||
| Ubuntu 18.04 LTS | | | | | |||
| Ubuntu 20.04 LTS | | | | | | | |
| Ubuntu 22.04 LTS | | | | | | | |
| Ubuntu 24.04 LTS | | | | |
| Port | TCP/UDP | Used by... | TYPE OF INSTALLATION | |
|---|---|---|---|---|
| All | Distributed / High Availability | |||
| 80 | TCP | Gateway | X | |
| 443 | TCP | SSL. When Tableau Server is configured for SSL, the application server redirects requests to this port. Do not change this port. | X | |
| 8850 | TCP | Tableau Services Manager. | X | |
| 8060 | TCP | PostgreSQL database. | X | |
| 8061 | TCP | PostgreSQL backup verification port | X | |
| 8000-9000 | TCP | Range of ports reserved by default for dynamic mapping of Tableau processes | X | |
| 27000-27009 | TCP | Range of ports used by Tableau Server for Licence service. This range must be open on the node running the Licence service and accessible from other nodes. By default, the initial node runs the Licence service. | X | |
| Not supported. Table X has two incoming relationships that are both from tables downstream from Base Table A | Supported. Tables S and T both have multiple incoming relationships, but each one is from a different base table. | Supported. Although it may visually look like there's a cycle, the incoming relationships for both Table S and Table T can be traced back to different base tables. |
 |  |  |
| Configuration key | Location of affected logs (path begins with |
Changes TSM logging levels for: activationservice, appzookeeper, backuprestore, clientfileservice, databasemaintenance, licenseservice, siteimportexport, tabadminagent, tabadmincontroller, tabsvc |
example: |
Changes TSM logging levels for: control applications |
examples:
|
Valid process names are backgrounder, vizportal, vizqlserver, dataserver Note: These are not dynamically configurable. | /vizqlserver/*.txt |
Changes logging levels for: Backgrounder | /backgrounder/*.log |
Changes logging levels for: Cluster Controller | /clustercontroller/*.log |
Changes logging levels for: Data Server | /dataserver/*.log |
Changes logging levels for: File Store | /filestore/*.log |
Changes logging levels for: Gateway control processes | /gateway/*.log |
Note: added in version 2021.3.0 Changes logging levels for: Gateway | /gateway/*.log |
Changes logging levels for: Hyper | /hyper/*.log |
Changes logging levels for: Data Source Properties service | /tdsservice/*.log |
Changes logging levels for microservices in: Interactive Microservice Container and Non-Interactive Microservice Container | /tomcatcontainer/*.log |
Changes logging levels for: Application Server | /vizportal/*.log |
Changes logging levels for: VizQL Server | /vizqlserver/*.log |
| Environment Variable | Recommended Value | Description |
|---|---|---|
FILESTORE_MOUNT_PATH | /docker/dataengine | External Filestore directory mount location. This directory should point to the dataengine NFS directory mounted inside each deployed Tableau container. For more information about External Filestore, see Tableau Server External File Store. The value should be the same for the Tableau Server in a Container pod and the Backgrounder pod. |
CLONE_ARTIFACT_DIR | /docker/clone/clone-artifacts | Clone configuration directory mount location. This directory should point to an NFS directory mounted inside each Tableau container. Tableau Server will output configuration data that Backgrounder Pods consume to become members of the cluster. |
ROOT_LOG_DIR | /var/log/tableau | (Backgrounder pods only) Common log directory location for all services running in a backgrounder pod. |
This explanation shows:
Exploration options:
Next steps for analysis:
|
In this example, a single extreme value of 463 hours rented is contributing to the higher-than-expected sum of Total Time Rented of 613 hours. A likely reason for this high value could be that someone forgot to dock the bike when they returned it. In this case, the author might want to exclude this value for future analysis.
| |
Visualise the DifferenceThis section shows:
Exploration options:
Next steps for analysis:
| 
In this example, when the extreme value of 483 is excluded, the analysed mark is no longer high compared to other marks in the view. Other marks now stand out. The author might want to explore the other marks to consider why these other locations have higher hours for bike rentals. |
icon to see a larger version of the visualisation.
This explanation shows:
Exploration options:
Next steps for analysis:
|
In this example, the percentage of null values in the target measure is shown as a blue circle. |
This explanation shows:
Exploration options:
Next steps for analysis:
|
In this example, the number of records for Trip Distance is listed for each value of Ride Month, which is a dimension in the original visualisation. August has the highest total trip distance value. You might explore whether August has the highest value for trip distance because more rides occurred in August, or if it has the highest trip distance because some rides were longer. |
This explanation shows:
Exploration options:
Next steps for analysis:
|  In this example, the average trip distance for August is not significantly higher or lower than most months. This suggests that trip distance is higher for August because there were more rides in August, rather than from people taking longer rides. |
This explanation shows:
Exploration options:
Next steps for analysis:
|  In this example, the statistical analysis has exposed that many of the rides come from the station neighbourhood of Back Bay. Note that Station Neighbourhood is an unvisualised dimension that has some relationship to Trip Distance in the underlying data for the source visualisation. |
This explanation shows:
Exploration options:
Next steps for analysis:
|  In this example, the statistical analysis has exposed that more rides were taken from South Station and MIT and fewer rides were taken from Charles Circle and Kendall, compared to rides taken for marks overall. Note that Station Name is an unvisualised dimension that has some relationship to Trip Distance in the underlying data for the source visualisation. |
This explanation shows:
Exploration options:
Next steps for analysis:
|  In this example, one possible reason why trip distance is high is because the average total time rented is also high. |
This explanation shows:
Exploration options:
Next steps for analysis:
|  In this example, a high percentage of records are associated with overcast weather. Because the data is about bike rentals in Boston, and the analysed mark is Trip Distance for August, we can assume that the weather is typically warm and humid. People might have rented bikes more often on overcast days to avoid the heat. It's also possible there were more overcast days in August. |
Column title | Can it be edited? | Description |
|---|---|---|
source_name | No | A user group name on the source site. |
source_domain_name | No | The identity store type on the source site: either local (for local identity store) or a domain name (for Active Directory or LDAP external identity store). |
target_domain_name | Yes* | The identity store type on the target site: either local for local identity store, or a domain name (such as example.com or example.lan) for Active Directory or LDAP external identity store. *For the All Users group, keep the target_domain_name value set to local, even if your target server is configured for Active Directory identity store. The All Users group is a special default user group that must exist on every Tableau Server. |
Column title | Can it be edited? | Description |
|---|---|---|
source_name | No | The names of custom and default extract or subscription schedules on the source site. |
source_scheduled_action_type | No | The type of schedule, either Refresh Extract, for extract refreshes or Subscriptions, for subscription deliveries on the source site. |
target_name | Yes | The names of custom schedules on the target site. You can edit this value. For example, if the schedule is named Friday Update on the source site you can rename it Friday Refresh on the target site. |
target_scheduled_action_type | No* | The type of schedule, either Refresh Extract, for extract refreshes or Subscriptions, for subscription deliveries on the target site. *In the rare case that you see question marks ( |
Column title | Can it be edited? | Description |
|---|---|---|
source_url_namespace | No | The site ID of the source site. |
target_url_namespace | No | The site ID of the target site. |
Column title | Can it be edited? | Description |
|---|---|---|
source_name | No | The user name attribute of a user on the source site. |
source_domain_name | No | The identity store type on the source site: either local (for local identity store) or a domain name (for Active Directory or LDAP identity store), or external. |
target_name | Yes | The user name attribute for users who will be assigned to the target site upon import. Confirm that all the user names in the list exist on the target server, and replace question marks ( You cannot create user names by adding rows to the CSV file. Similarly, you cannot remove user names by deleting rows. You can edit a user name in the target_name column to be different from its source user name, as long as the user already exists on the target server with that name. For example, a user can have a source_name value of agarcia@company.com and a target_name value of ashleygarcia@company.com. You can map a user on the source site to only one user name on the target site. |
target_domain_name | Yes | The identity store type on the target site: either local (for local identity store) or a domain name (for Active Directory or LDAP external identity store). |
configEntities option (Options are case sensitive) | Native tsm command | configKey (Used with tsm configuration set command or in the configKeys section of a JSON file) | Scenario | Notes |
|---|---|---|---|---|
| type | N/A | wgserver.authenticate | AD, LDAP, Local | Where you want to store user identity information. Values: local or activedirectory.If you want to connect to any LDAP server, enter |
| sslPort | N/A | wgserver.domain.ssl_port | AD, LDAP | Use this option to specify the secure port of the LDAP server. We recommend secure LDAP for simple bind. LDAPS is usually port 636. |
| N/A | N/A | wgserver.domain.ldap.starttls.enabled | AD, LDAP | Values: Beginning with version 2021.2, this key is set to This key is set to This key was introduced (but not set) in version 2021.1. |
| port | N/A | wgserver.domain.port | AD, LDAP | Use this option to specify the non-secure port of the LDAP server. Plaintext is usually 389. |
| domain | domain | wgserver.domain.default | AD | In Active Directory environments, specify the domain where Tableau Server is installed, for example, "example.lan". For non-AD LDAP: the string you enter for this value is displayed in the "Domain" column of user management tools. You can enter an arbitrary string, but the key cannot be blank. This key is redundant with wgserver.domain.fqdn. The values for both keys must be the same. Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| username | ldapusername | wgserver.domain.username | AD, LDAP | The user name that you want to use to connect to the directory service. The account that you specify must have permission to query the directory service. For Active Directory, enter the username, for example, For LDAP servers, enter the distinguished name (DN) of the user that you want to use to connect. For example, Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| password | ldappassword | wgserver.domain.password | AD, LDAP | The password of the user account that you will use to connect to the LDAP server. Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| directoryServiceType | N/A | wgserver.domain.directoryservice.type | AD, LDAP | The type of LDAP directory service that you want to connect to. Values:activedirectory or openldap. |
| kerberosPrincipal | kerbprincipal | wgserver.domain.ldap.principal | AD, LDAP | The service principal name for Tableau Server on the host machine. The keytab must have permission for this principal. Do not use the existing system keytab at /etc/krb5.keytab. Rather, we recommend that you register a new service principal name. To see principals in a given keytab, run the klist -k command. See Understanding Keytab Requirements.Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| hostname | hostname | wgserver.domain.ldap.hostname | AD, LDAP | The hostname of the LDAP server. You can enter a hostname or an IP address for this value. The host that you specify here will be used for user/group queries on the primary domain. In the case where user/group queries are in other domains, Tableau Server will query DNS to identify the appropriate domain controller. Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| membersRetrievalPageSize | N/A | wgserver.domain.ldap.members.retrieval.page.size | AD, LDAP | This option determines the maximum number of results returned by an LDAP query. For example, consider a scenario where Tableau Server is importing an LDAP group that contains 50,000 users. Attempting to import such a large number of users in a single operation is not a best practice. When this option is set to 1500, Tableau Server imports the first 1500 users in the first response. After those users are processed, Tableau Server requests the next 1500 users from the LDAP server, and so forth. We recommend that you modify this option only to accommodate the requirements of your LDAP server. |
| N/A | N/A | wgserver.domain.ldap.connectionpool.enabled | AD, LDAP | When this options is set to true, Tableau Server will attempt to reuse the same connection when sending queries to the LDAP server. This behaviour decreases the overhead of having to re-authenticate with the LDAP server on each new request. Connection pooling only works with simple bind and TSL/SSL bind connections. Connection pooling is not supported for GSSAPI bind connections. |
| N/A | N/A | wgserver.domain.accept_list | AD | Allows connection from Tableau Server to secondary Active Directory domains. A secondary domain is one that Tableau Server connects to for user synchronisation, but is a domain where Tableau Server is not installed. To ensure that Tableau Server can connect to other Active Directory domains, you must specify the trusted domains by setting the wgserver.domain.accept_list option with TSM. For more information, see wgserver.domain.accept_list. |
| N/A | N/A | wgserver.domain.allowlist | AD | Important: Deprecated as of version 2020.4.0. Use wgserver.domain.accept_list instead. Allows connection from Tableau Server to secondary Active Directory domains. A secondary domain is one that Tableau Server connects to for user synchronisation, but is a domain where Tableau Server is not installed. To ensure that Tableau Server can connect to other Active Directory domains, you must specify the trusted domains by setting the |
| kerberosConfig | kerbconfig | No direct mapping | AD, LDAP | The path to the Kerberos configuration file on the local computer. If you are installing into Active Directory, we don't recommend using the existing Kerberos configuration file or keytab file that may already be on the domain-joined computer. See Identity Store Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| kerberosKeytab | kerbkeytab | No direct mapping | AD, LDAP | The path to the Kerberos keytab file on the local computer. It is recommended that you create a keytab file with keys specifically for Tableau Server service and that you do not share the keytab file with other applications on the computer. For example, on Linux, you might place the keytab file in the Native tsm command: Uses tsm user-identity-store set-connection [options] command. |
| nickname | N/A | wgserver.domain.nickname | AD, LDAP | The nickname of the domain. This is also referred to as the NetBIOS name in Windows/Active Directory environments. The |
| root | N/A | wgserver.domain.ldap.root | LDAP | If you do not use a dc component in the LDAP root or you want to specify a more complex root you need to set the LDAP root. Use the "o=my,u=root" format. For example, for the domain, example.lan, the root would be "o=example,u=lan". |
| serverSideSorting | N/A | wgserver.domain.ldap.server_side_sorting | LDAP | Whether the LDAP server is configured for server-side sorting of query results. If your LDAP server supports server-side sorting, set this option to true. If you are unsure whether your LDAP server supports this, enter false, as misconfiguration may cause errors. |
| rangeRetrieval | N/A | wgserver.domain.ldap.range_retrieval | LDAP | Whether the LDAP server is configured to return a range of query results for a request. This means that groups with many users will be requested in small sets instead of all at once. LDAP servers that support range retrieval will perform better for large queries. If your LDAP server supports range retrieval, set this option to true. If you are unsure whether your LDAP server supports range retrieval, enter false, as misconfiguration may cause errors. |
| bind | N/A | wgserver.domain.ldap.bind | LDAP | The way that you want to secure communication to the directory service. Enter simple for LDAP unless you are connecting to an LDAP server with Kerberos. For Kerberos, enter gssapi. |
| N/A | N/A | wgserver.domain.ldap.domain_custom_ports | LDAP | Note: This key is only supported for Tableau Server on Linux. Allows you to map child domains and their LDAP ports. Domain and port are separated by a colon (:) and each domain:port pair is separated by a comma (,) using this format: Example: |
| distinguishedNameAttribute | N/A | wgserver.domain.ldap.dnAttribute | LDAP | The attribute that stores the distinguished names of users. This attribute is optional, but it greatly improves the performance of LDAP queries. Important: Do not set this option as part of the initial configuration. Only set this after you have validated overall LDAP functionality. You must have a dnAttribute set in your organisation before setting this key. |
| groupBaseDn | N/A | wgserver.domain.ldap.group.baseDn | LDAP | Use this option to specify an alternative root for groups. For example, if all of your group are stored in the base organisation called "groups," then enter |
| N/A | classnames | wgserver.domain.ldap.group.classnames | LDAP | By Default, Tableau Server will look for "group", "groupOfNames" or "groupOfURLs". If your LDAP group objects do not fit the default class name, override the default by setting this value. You can provide multiple classnames separated by commas. If your group names include commas, you must avoid them by using a backslash (\). For example, if you have a group name, Tableau LDAP implementation interprets LDAP objects as either user or group. Therefore, be sure that you are entering the most specific class name. Overlapping class names between users and groups may cause conflicts. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command. |
| groupBaseFilter | basefilter | wgserver.domain.ldap.group.baseFilter | LDAP | The filter that you want to use for groups of users of Tableau Server. You might specify an object class attribute and an organisation unit attribute. For example:
If This is a required key. It cannot be blank. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command. |
| groupName | groupname | wgserver.domain.ldap.group.name | LDAP | The attribute that corresponds to group names on your LDAP server. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command. |
| groupEmail | groupemail | wgserver.domain.ldap.group.email | LDAP | The attribute that corresponds to group email addresses on your LDAP server. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command. |
| groupDescription | description | wgserver.domain.ldap.group.description | LDAP | The attribute that corresponds to group descriptions on your LDAP server. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command. |
| member | member | wgserver.domain.ldap.group.member | LDAP | Specify the LDAP attribute that contains a list of distinguished names of users that are part of that group. Native tsm command: Uses tsm user-identity-store set-group-mappings [options] command. |
| N/A | N/A | wgserver.domain.ldap.group.memberURL | LDAP | Specify the name of the LDAP attribute that stores the LDAP query for dynamic groups. |
| userBaseDn | N/A | wgserver.domain.ldap.user.baseDn | LDAP | Use this option to specify an alternative root for users. For example, if all of your users are stored in the base organisation called "users," then enter "o=users". |
| N/A | classnames | wgserver.domain.ldap.user.classnames | LDAP | By default Tableau Server looks for LDAP user object classes containing the string “user” and “inetOrgPerson”. If your LDAP user objects do not use these default class names, override the default by setting this value. You can provide multiple classnames separated by commas. For example: If your names include commas, you must escape them with a backslash (\). For example, if you have a name, Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| userBaseFilter | basefilter | wgserver.domain.ldap.user.baseFilter | LDAP | The filter that you want to use for users of Tableau Server. You might specify an object class attribute and an organisation unit attribute. For example:
Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| userUsername | ldapusername | wgserver.domain.ldap.user.username | LDAP | The attribute that corresponds to user names on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| userDisplayName | displayname | wgserver.domain.ldap.user.displayname | LDAP | The attribute that corresponds to user display names on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| userEmail | wgserver.domain.ldap.user.email | LDAP | The attribute that corresponds to user email addresses on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. | |
| userCertificate | certificate | wgserver.domain.ldap.user.usercertificate | LDAP | The attribute that corresponds to user certificates on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| N/A | thumbnail | wgserver.domain.ldap.user.thumbnail | LDAP | The attribute that corresponds to user thumbnail images on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| userJpegPhoto | jpegphoto | wgserver.domain.ldap.user.jpegphoto | LDAP | The attribute that corresponds to user profile images on your LDAP server. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| memberOf | memberof | wgserver.domain.ldap.user.memberof | LDAP | Group that the user is a member of. Native tsm command: Uses tsm user-identity-store set-user-mappings [options] command. |
| groupClassNames | N/A | wgserver.domain.ldap.group.classnames | LDAP | By Default, Tableau Server will look for "group", "groupOfNames" or "groupOfURLs". If your LDAP group objects do not fit the default class name, override the default by setting this value. For configEntity: This option takes a list of strings, which requires passing each class in quotes, separated by a comma (no space) and within brackets. For example: For configKey: Enter each class, separated by a comma (no space) and within double quotes. For example: |
| userClassNames | N/A | wgserver.domain.ldap.user.classnames | LDAP | By default Tableau Server looks for LDAP user object classes containing the string “user” and “inetOrgPerson”. If your LDAP user objects do not use these default class names, override the default by setting this value. For configEntity: This option takes a list of strings, which requires passing each class in quotes, separated by a comma (no space) and within brackets. For example: For configKey: Enter each class, separated by a comma (no space) and within double quotes. For example: |
| Calculated configKey | To use the native TSM command: | To use configEntity json: |
|---|---|---|
wgserver.domain.ldap.kerberos.conf, cfs.ldap.kerberos.conf | Set the Kerberos configuration file location with the | Set the Kerberos configuration file location with the kerberosConfig configEntity option. |
wgserver.domain.ldap.kerberos.keytab, cfs.ldap.kerberos.keytab | Set the Kerberos keytab file location with the kerbkeytab option of tsm user-identity-store set-connection [options] command. | Set the Kerberos ketytab file location with the kerberosKeytab configEntity option. |