Set up Looker indexing

The Looker connector is the discovery layer for Glean. It indexes permission-aware metadata from Looker so users can find governed content in Glean Search and Assistant.

The connector does not index warehouse rows or execute live analytics queries. To answer questions about current Looker data, set up Looker in Assistant after configuring indexing.

Supported scope

The connector supports hosted Looker instances that expose the Looker API. Customer-hosted or on-premises Looker instances are not supported.

Saved content

The connector indexes the following saved-content types:

• Looks: Title, description, folder, creator, update information, usage counts, model identifier when available, and a link to the Look in Looker
• User dashboards: Title, description, folder, creator, update information, dashboard element text, and a link to the dashboard in Looker
• LookML dashboards: Title, description, folder or built-in location when available, dashboard element text, model identifier when available, and a link to the dashboard in Looker

Dashboard element text can include visualization titles, title cards, subtitles, body text, notes, and text or descriptions from linked Looks.

Optional semantic metadata

When semantic indexing is enabled for the Looker connector, Glean indexes a limited set of semantic metadata:

• Models: Model name and label
• Explores: Model name and label, Explore name and label, description, and group label

Glean publishes only visible Explores whose effective LookML definition has no required access grants. Hidden, gated, or unclassifiable Explores are omitted. Semantic documents are permission-aware and are intended to route users to the correct Looker Model or Explore; they are not a copy of the Looker semantic layer.

Requirements

Before you configure the connector, confirm that you have:

• A supported, hosted Looker instance with the Looker API available
• A Looker admin account, or an account with sufficient privileges to create or manage API3 credentials
• An API3 client ID and client secret generated in Looker
• A Looker API credential whose user can list Looker users (see_users) and access the content and role information that Glean must crawl

Set up the connector

1. Identify the Looker instance qualifier

For the connector, enter the part of the Looker hostname before .looker.com. Record this qualifier; you enter it in Glean’s Instance name field in step 3.

• If the Looker URL is https://acme.looker.com, enter acme.
• If the Looker URL is https://acme.cloud.looker.com, enter acme.cloud.

Do not enter the full hostname or https://. This value is different from the full instance host required when you configure the managed Looker MCP server in Looker in Assistant.

2. Generate Looker API3 credentials

For more information about generating API credentials, see Looker API authentication.

The credential steps depend on your Looker edition:

Looker (original):

1. Sign in to your Looker instance as an administrator.
2. Open the Admin panel and go to Users.
3. Select Edit for the user whose API credentials Glean will use.
4. Open API Keys and select Edit Keys.
5. Create or use an API3 key, then copy the Client ID and Client Secret.

Looker (Google Cloud core):

1. Ask a Looker administrator to enable API credential management for your user on the Admin panel’s Users page.
2. Open your Account page and go to API Keys.
3. Create or use an API3 key, then copy the Client ID and Client Secret.

Store the client secret securely. Glean uses the client credentials to obtain and refresh a short-lived bearer token for connector API requests.

3. Configure indexing in Glean

important

Use the Looker API3 credentials from the previous step, not the OAuth client credentials used for Looker in Assistant.

1. In Glean, navigate to Admin console > Connectors > Add connector.
2. Select Looker.
3. Enter the following values in the setup form:
   • Connector name: An organization-visible name for this Looker indexing connection, such as Acme Looker.
   • Instance name: The Looker hostname qualifier before .looker.com, such as acme or acme.cloud. Do not enter the full hostname or https://.
   • API Client ID: The Client ID from the Looker API3 key.
   • API Client Secret: The Client Secret from the same Looker API3 key.
4. Select Save.
5. Run or wait for the initial full crawl, then verify that expected Looks and dashboards appear in Glean Search.

4. Enable semantic indexing (optional)

Semantic indexing is optional and is not required for saved-content indexing or the managed Looker MCP connection. It is rollout-controlled, so the setting may not appear in every deployment. If semantic indexing is not available in your connector configuration, contact Glean Support or your Glean representative to confirm availability.

To build the semantic index, the indexing credential must be able to read Looker Models and list and read the LookML project files required for each Model and its included files. Saved-content indexing does not use these project-file requests.

1. Confirm that ModelSet-aware identity crawling is enabled for the Looker connector.
2. Enable semantic indexing for the connector.
3. Save the configuration and wait for the next successful semantic full crawl.
4. Search for a known Model or Explore to verify publication.

Glean does not publish semantic documents from a partial or failed snapshot. The semantic crawl runs after the Looker identity full crawl, but this dependency does not independently verify that identity data is complete or current. Review the identity crawl status before relying on semantic permissions.

Permissions and security

For saved Looks and dashboards, Glean applies Looker permissions in two layers:

1. Content access: Looker returns the users permitted to access a content item through its content metadata.
2. Role and ModelSet access: Glean evaluates the user’s Looker roles, permission sets, and ModelSets. Relevant permissions include see_looks, see_user_dashboards, and see_lookml_dashboards.

A user must satisfy both layers to see a permissioned saved-content result in Glean. Looker administrators are retained as an explicit fallback audience.

Public Looks are treated as public content by the connector. Do not mark a Look as public unless its data and link are intended for public access.

For semantic documents, Glean uses a separate Model query-access audience based on the Looker role permissions access_data and explore and the role’s ModelSet. Explores with effective required_access_grants are not indexed; Glean does not attempt to evaluate user-attribute-derived access grants during semantic crawling.

Indexed visibility does not grant live query access. When Assistant uses the managed Looker MCP server, Looker authorizes the request as the user who connected their Looker account.

Crawling and freshness

• Saved Looks and dashboards use periodic full crawls.
• Semantic Models and Explores use a separate semantic full crawl when semantic indexing is enabled.
• Incremental and activity crawls are not implemented for Looker.
• Webhook-based updates are not used.
• Content, permission, and semantic-index changes appear after the relevant successful crawl and indexing pipeline complete.

Limitations

• Customer-hosted or on-premises Looker is not supported.
• The connector indexes metadata, not warehouse rows, query results, or raw LookML.
• Explore fields, measures, dimensions, filters, and parameters are retrieved live by the MCP integration rather than indexed as semantic documents.
• Hidden, gated, or unclassifiable Explores are excluded from semantic indexing.
• Redlist/greenlist filters, custom object selection, and lookback-period configuration are not available for the connector.
• The connector does not create, update, delete, publish, or otherwise modify Looker content.