Databricks
Connect a Databricks SQL warehouse and Unity Catalog to Better Analyst with a least-privilege service principal or access token, then chat, build dashboards, and run Data Flows.
Connect your Databricks lakehouse to analyze Unity Catalog tables with natural language, build dashboards with scheduled refresh, set alerts, and use Databricks as a Data Flow source or destination.
Prerequisites
- A Databricks workspace with Unity Catalog
- A SQL warehouse (serverless, pro, or classic) the connecting principal can use
- A personal access token, or an OAuth service principal (recommended)
Connection Details
| Field | Description | Example |
|---|---|---|
| Server hostname | Workspace hostname, without https:// | dbc-a1b2c3d4-e5f6.cloud.databricks.com |
| HTTP path | SQL warehouse HTTP path | /sql/1.0/warehouses/abc123def456 |
| Authentication | Access token, or service principal client ID and OAuth secret | dapi… / 1f6c… + secret |
| Catalog | Default Unity Catalog catalog | main |
| Schema | Default schema (optional) | default |
Find the hostname and HTTP path in SQL Warehouses > your warehouse > Connection details.
Setup Steps
1. Create a least-privilege service principal
In the account console (or workspace settings), create a service principal, generate an OAuth secret for it, and give it Can use on the SQL warehouse. Then grant only read privileges in Unity Catalog:
GRANT USE CATALOG ON CATALOG main TO `better-analyst-sp`;
GRANT USE SCHEMA ON SCHEMA main.analytics TO `better-analyst-sp`;
GRANT SELECT ON SCHEMA main.analytics TO `better-analyst-sp`;
Databricks SQL has no read-only transactions. Better Analyst validates every query as a single read-only SELECT, and protected reads also verify that the principal holds no write, MANAGE, ALL PRIVILEGES, or ownership grants (directly or through its groups). A principal that owns objects or can modify data is refused, so use a dedicated principal rather than an admin or personal account.
A personal access token also works for evaluation; the same least-privilege checks apply to the user who owns it.
2. Connect in Better Analyst
- Go to Connectors > Add Connector
- Select Databricks
- Enter the hostname, HTTP path, credentials, and catalog
- Click Connect Databricks
A stopped serverless warehouse can take a few seconds to start on the first query.
Writing SQL for Databricks
The AI writes Databricks SQL (Spark SQL) with three-part names such as main.analytics.orders, backtick-quoted identifiers, and functions like date_trunc, date_add, datediff, and try_cast.
Queries are refused when they read the system catalog, file paths (read_files, delta./parquet. path tables), secrets, or external functions, and legacy hive_metastore tables cannot be used for protected reads.
Data Access and Per-Member Rows
Use Data Access to choose tables and columns and to add per-member row rules, exactly as for other databases. Rules are applied by wrapping each protected table before the query runs, and a view that reads a row-protected table is refused so it cannot bypass the rule.
Dashboards, Alerts, and Data Flows
- Dashboards built from Databricks refresh on a schedule through the same protected read path.
- Alerts run on Data Flows.
- Databricks can be a Data Flow source and, with Read and write access for one schema, a destination (Delta tables are replaced, appended, or merged on a key).
Example Questions
- "What tables are in the analytics schema?"
- "Total revenue by region last quarter"
- "Weekly active users for the last 12 weeks"
- "Which products are frequently bought together?"