Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington...

14
Splunk and the Weather Powered by the Dark Sky API Somen De | Function1 September 27, 2017 | Washington, DC

Transcript of Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington...

Page 1: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Splunk and the WeatherPowered by the Dark Sky API

Somen De | Function1

September 27, 2017 | Washington, DC

Page 2: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

During the course of this presentation, we may make forward-looking statements regarding future events or the expected performance of the company. We caution you that such statements reflect our current expectations and estimates based on factors currently known to us and that actual events or results could differ materially. For important factors that may cause actual results to differ from those contained in our forward-looking statements, please review our filings with the SEC.

The forward-looking statements made in this presentation are being made as of the time and date of its live presentation. If reviewed after its live presentation, this presentation may not contain current or accurate information. We do not assume any obligation to update any forward looking statements we may make. In addition, any information about our roadmap outlines our general product direction and is subject to change at any time without notice. It is for informational purposes only and shall not be incorporated into any contract or other commitment. Splunk undertakes no obligation either to develop the features or functionality described or to include any such feature or functionality in a future release.

Splunk, Splunk>, Listen to Your Data, The Engine for Machine Data, Splunk Cloud, Splunk Light and SPL are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2017 Splunk Inc. All rights reserved.

Forward-Looking Statements

THIS SLIDE IS REQUIRED FOR ALL 3 PARTY PRESENTATIONS.

Page 3: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

▶ Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago▶ One of Splunk’s premier professional services partners▶ More than 1,000 successful Splunk engagements spanning all industry verticals: Security,

Finance, Energy, E-Commerce, Government, Defense, Healthcare, Entertainment, Retail, and Education

▶ Services: Installation & Upgrades, Data Onboarding, Training, Dashboard & App Development, Products, Health Checks, Consulting

▶ Our team of Splunk experts is credited with designing the base architecture for some of the largest Splunk deployments to-date and have aided in developing the standard for enterprise class governance and data onboarding

About Function1www.function1.com

Page 4: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

© 2017 SPLUNK INC.

- Mark Twain

“Climate Is What We Expect, Weather Is What We Get.”

Page 5: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

▶ At Function1, we blog quarterly and are encouraged to find new and exciting ways to utilize Splunk

Splunk - Function1 - Dark Sky API

Page 6: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Dark Sky APIQuick Overview

▶ The Dark Sky API allows you to look up the weather anywhere on the globe, returning (where available):• Current weather conditions• Minute-by-Minute forecasts out to one hour• Hour-by-hour and day-by-day forecasts out to seven days• Hour-by-hour and day-by-day observations going back decades

▶ They provide two types of API requests:• A Forecast Request returns the current weather forecast for the next week in JSON format.• A Time Machine Request returns the observed or forecast weather conditions for a date in

the past or future in the same JSON format.

Page 7: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

▶ Data can be historical or from the future!• Anytime in the past or future• Just pass in an epoch time variable

▶ Data can be searched and charted in intervals• Currently• Daily• Hourly• Minutely

▶ Data is returned in neat and clean JSON• props.conf

Dark Sky APIWhy it’s Perfect for Splunk

Page 8: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Visualize Weather TrendsMax Temperature vs Min Temperature, per day, over 1 year

Lower Manhattan

Page 9: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Visualize Weather TrendsPrecipitation Intensity, Summer 2016

Lower Manhattan

Page 10: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Visualize Weather TrendsAverage Wind Speed, per day, October 2016

Lower Manhattan

Page 11: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

▶ The Dark Sky API offers fields that Splunk can utilize to forecast Rain• Dewpoint• Humidity• Pressure• Cloud Cover

▶ We also set up a simple ”eval” to create a field that we run the prediction on• eval rain=if(LIKE(summary,"%Rain%"),"rain","norain")

Predict the Weather!How Can We Predict if it will Rain?

Page 12: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Predict the Weather!Use the Splunk Machine Learning Toolkit

Page 13: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

Predict the Weather!Use the Splunk Machine Learning Toolkit

Page 14: Splunk and the Weather - .conf20 | Splunk · 27/09/2017  · Founded in 2007; offices in Washington D.C., New York City, Toronto, and Chicago One of Splunk’s premier professional

© 2017 SPLUNK INC.

Don't forget to rate this session in the .conf2017 mobile app

Thank You


30 WAYS TO USE SPLUNK IN FINANCIAL SERVICES · Splunk’s real-time analytics capabilities lend themselves well to analyzing transactions, and as a result some of the world’s largest

30 WAYS TO USE SPLUNK IN FINANCIAL SERVICES · Splunk’s real-time analytics capabilities lend themselves well to analyzing transactions, and as a result some of the world’s largest

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

Splunk conf2014 - Splunk Monitoring - New Native Tools for Monitoring your Splunk Deployment

BOOZ ALLEN CYBER4SIGHT FOR SPLUNK: … Allen Cyber4Sight® for Splunk fuses Booz Allen’s human-derived intelligence with the power of Splunk’s analytics-driven security to deliver

BOOZ ALLEN CYBER4SIGHT FOR SPLUNK: … Allen Cyber4Sight® for Splunk fuses Booz Allen’s human-derived intelligence with the power of Splunk’s analytics-driven security to deliver

Best Practices for Splunk SSL (The SSLippery Slope Revisited)Splunk’s default SSL posture 5 But for Splunk 6.3.3.4 / 6.3.4 Apparently turns off SSLv3 by default (undocumented) Breaks

Best Practices for Splunk SSL (The SSLippery Slope Revisited)Splunk’s default SSL posture 5 But for Splunk 6.3.3.4 / 6.3.4 Apparently turns off SSLv3 by default (undocumented) Breaks

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad itinnovation@contacts.bham.ac.uk Indexing 2.2.1 Searching using splunk Splunk uses

Splunk Review - University of Birmingham · Ref: Splunk Review, Dec 2014 Mohammad Rameez Shafsad [email protected] Indexing 2.2.1 Searching using splunk Splunk uses

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

SplunkingYour Mobile Apps - .conf19 | Splunk · Introducing Splunk for Mobile Intelligence (Splunk MINT) Deploying Splunk MINT – Intro to SDKs – Getting Started Using Splunk MINT

Understanding+and+ Improving+Customer+ ... - .conf20 | Splunk · The+John+Lewis+Splunk+Architecture+ Forwarders Job Server (Active) Job Server (Passive) Search Heads Search Heads

Understanding+and+ Improving+Customer+ ... - .conf20 | Splunk · The+John+Lewis+Splunk+Architecture+ Forwarders Job Server (Active) Job Server (Passive) Search Heads Search Heads

Security Hands-on @ Pavilion - .conf20 | Splunk · Security Hands-on @ Pavilion Stream + NetFlow for Security & Insider Threat Detection Kelly Feagans | Sales Engineering September

Security Hands-on @ Pavilion - .conf20 | Splunk · Security Hands-on @ Pavilion Stream + NetFlow for Security & Insider Threat Detection Kelly Feagans | Sales Engineering September

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

Splunk Cloud の製品概要 › ... › product-briefs › splunk-cloud.pdfSplunk App で機能を強化 Splunk Cloud は、Splunk Enterprise Security や Splunk IT Service Intelligence

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

stoQ’ing your Splunk - SANS · PDF filestoQ’ingyour Splunk Ryan Kovar, Splunk Marcus LaFerrera, PUNCH SANS DFIR 2016

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

Splunk のご紹介 - hitachi.co.jp · Splunkの歴史. 5 . 2006 . Splunk 1 . Splunk 2 . 2007 . Splunk 3 . 2009 . Splunk 4 . 2010 . Splunk 4.1 . 2011 Splunk 4.2 . App for Enterprise

SPLUNK’S DGA MACHINE LEARNING APPLICATION

SPLUNK’S DGA MACHINE LEARNING APPLICATION

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Rivium Splunk Windows · o Splunk Enterprise Security * o uberAgent* o Splunk App for Web Analytics Common Splunk Apps & Add-ons 15 SplunkingWIndows o Splunk Add-on for Microsoft

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Tenable and Splunk Integration · Splunk Splunkreceivesvulnerabilitydatacollectedby SecurityCenter Nessus NessusHost Scans,Nes-susPlugins Splunk SplunkreceivesvulnerabilitydatacollectedbyNes-

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Admission Control using Splunk Enterprise Deployment Guide€¦ · Configuring Splunk Enterprise ... For more information on Splunk configuration, see Splunk documentation. Troubleshooting

Splunk Overviewsplunk402.com/wp-content/uploads/2015/01/AITP.pdf · Agenda • What is Splunk? • What is Machine Data? • Splunk’s Interface • Troubleshooting with Splunk •

Splunk Overviewsplunk402.com/wp-content/uploads/2015/01/AITP.pdf · Agenda • What is Splunk? • What is Machine Data? • Splunk’s Interface • Troubleshooting with Splunk •

Splunk conf2014 - Splunk for Data Science

Splunk conf2014 - Splunk for Data Science

Splunk in Rakuten: Splunk as a Service for all

Splunk in Rakuten: Splunk as a Service for all

Deploying Splunk. Arquitetura e dimensionamento do Splunk

Deploying Splunk. Arquitetura e dimensionamento do Splunk

ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline

ICS/OT Devices And Assets Management Using Splunk...•Use Splunk’s Machine Learning ToolKit (MLTK) to plot Authentication and Network Traffic counts, from which you derive a baseline