Astronomy Part 3: Splunk, Megastructures, and ITSI

It’s been over half a decade since I wrote a blog entry here at Splunk about an astronomy related topic and that’s because I was just waiting for something interesting to talk about. In the past, I have spoken about star brightness, but recent news has taken this subject to another level.

For those, who may not be following, last fall, astronomers found an inexplicable property of a star almost 1500 light years away. Using Kepler spacecraft data, the star was shown to dim up to 22 percent of its original brightness at various times. To put this in perspective, the largest planets passing in front of a star only dim most stars less than one percent. So, it was obviously not a local planet causing the dimming. The real questions then become can this be a repeatable measurement, at what interval does this happen, and most importantly, what causes the dimming?

Measuring Brightness

Measuring the brightness of one star at various intervals is one thing, but it would behoove the scientific community to do the same for millions of stars in the galaxy to figure out repeatable patterns or if this is an unique occurrence. Since the Milky Way has more than 100 billion stars (Ok, we can rule out the flaring M Class stars comprising 70 percent of all stars and short lived mega stars, but you are still left with 25 billion plus stars), taking historical measurements and analyzing them for patterns for an explanation makes this a big data problem. I had wrote a long time ago that all this data can be stored in Splunk and for any given star, we can conceptually create a timechart of its brightness using whatever units you like such as this example.

Timechart Brightness


However, that is so 2010. There may be quite a few software packages out there to create this kind of chart (although you would still need a big data platform to store, retrieve, and analyze such a large growing data set). One could conceivably start collecting data for each star and use thresholds to create alerts when the brightness dims below a certain percentage. The percentage could be hard coded into rules (or Splunk searches) and adjusted as necessary. On the other hand, what if each star has its own peculiarity for the thresholds? Some stars may dim by 1 to 2 percent, which may make them rather uninteresting, but a dimming of 3 percent for the same star may mean a critical alert is needed. Similarly, the star in question for this blog, Tabby’s star, as it is now known as for the discoverer, has thresholds for dimming that are beyond anything ever seen. Automatic threshold adjustment is needed for what could be considered normal, high, and critical. Enter Splunk ITSI (IT Service Intelligence).

Spunk ITSI

Splunk IT Service Intelligence is a monitoring solution that offers innovative, real-time insights into service health against defined  key performance indicators (KPI) to drive operational and business decisions. Splunk ITSI can organize and correlate relevant metrics/events into ‘swim lanes’ to speed up investigations and diagnosis.

If we were to think of a star as a service, key performance indicators (or health scores) can be its brightness, temperature, UV light ouput, and IR light output among other things. Each KPI can have its own thresholds that can be computed dynamically over time to indicate what is normal, high, or critical. Now, instead of creating a plain timechart and using hard coded rules for thresholds, Splunk ITSI can use machine learning to auto-adjust the thresholds over time. The KPI for brightness (or dimming percentage depending on how you look at it) could end up looking something like this in Splunk ITSI.


In this hypothetical example, the star has dimmed over 20%, which is critical enough for someone to immediately investigate.

Moreover, since machine learning is used in Splunk ITSI, anomalies for the KPI could easily be detected and alerted upon.

Other KPI

One quick explanation that astronomers suggested for Tabby’s star dimming was a planetary collision at the time of measuring. I find this hard to believe because even the largest planet could only dim a star of this size by 1% and it would be incredibly strange for the fragments of a collision to line up in a blanket array to dim the star at such a large number. Scientifically, one could measure the IR light output increasing if a collision took place and correlate this with the dimming. This change in IR light measurement could also be a KPI for Splunk ITSI. In this case for Tabby’s star, no change in IR light was found.

Another explanation for the dimming that some scientist suggested was that a swarm of exo-comets just happened to be at the right place to dim the star. I find this equally as hard to believe as the number of comets needed (not to mention the enormous size of each comet) and the cooperative alignment of the comets to blanket the star makes it incredible. Scientifically, one could measure the UV light output around the star increasing as the comets swarm the star and this could be another KPI for Splunk ITSI.

Another KPI could be the star’s temperature meaning that perhaps, the temperature changes of the star has a direct relationship to its dimming percentage.  Putting all these KPI together within swim lanes could create a visual correlation for the cause of the dimming. Fortunately, Splunk ITSI has this capability to stack any KPI’s from any service together to visually correlate the results. Here’s a hypothetical example of this using the KPI that are mentioned here.

Swim Lanes

The astute reader will point out that half the stars found are binary stars or greater meaning that they have one or more companions. In this case Splunk ITSI has a concept called entities for which each star could be an entity and the comprised stars of the system could make up the service.

What we have shown here is that by using a platform such as Splunk ITSI, we can treat each notable star in the galaxy as a service, keep track of its KPI within a big data platform, use dynamic thresholds to monitor the service, find anomalies in the KPI, and finally group KPIs from any service within swim lanes to visually correlate possible root causes.

Possible Causes of the Dimming

If you’ve gotten this far reading this blog entry, you may want to ask what is causing this ordinary F class star to dim so much at various intervals. I will offer some more suggestions, for which I must admit, I am unqualified to backup, but it makes for interesting reading.

  • Instrument Error is one explanation. Many stars have been “dimming” over the last 100 years and it was found out that the way instruments measured the brightness over the years changed for the better, which means that no such dimming happened. However, for Tabby’s star, the dimming measurements are recent over the last several years and one cannot simply say new telescopes caused measurement discrepancies. I still find instrument error as the most probable cause as throughout history that has been the case for a number of measurement peculiarities. Some may recall how scientists thought that they had measured particles traveling faster than the speed of light a few years ago and it turned out to be measurement errors.
  • Some have suggested that it may be a brown dwarf star passing Tabby’s star at just the right time the dimming was measured. This would have be to a lucky coincidence. Since the dimming was measured more than once, it would be really difficult to figure out how this invisible brown dwarf star seems to pass undetected on a “frequent” basis.
  • Some intrinsic property of the star causes dimming. This means that the star itself is changing its brightness on non-predictable intervals for some unspecified reason. This is why it would be important to measure the dimming of millions (or even billions in the future) of stars to see if other stars could be caught in the same act. Even if more samples are found on a frequent basis, someone will have to come up with the physics for why a star can suddenly go dim.
  • What if none of the above is true and what if no changes can be found in IR and UV light output? That leaves the Science Fiction explanation of a Megastructure, where some alien civilization figured out a way to build some enormous apparatus around the star that may capture its energy causing it to dim to the outside observer. This may sound totally far out, but I find this explanation easier to digest than huge swarms of exo-comets perfectly arranged to dim a star. It is this explanation that has gotten most people excited about Tabby’s star. I will not speculate more than needed here. My real problem with a megastructure, even if true, is why would the star not be permanently dimmed, if it was blanketed by such a structure?

Public Domain Photo of Megastructure

What is happening is a kick starter effort to take more measurements at frequent intervals around Tabby’s star. Sadly, history has shown how we find interesting things in the cosmos that cannot be found again. The WOW signal and the Mars onsite life detection experiments from the 1970s come to mind. A past world without universal internet and social media left those events as part of history, with discussion limited to few. It would be sad to discover if no more extreme dimming can be measured for Tabby’s star. This is why I advocate that the “health” of many stars be measured and treated as a service with multiple KPIs. Our current limitation is the ability to gather the measurements at mass scale, but I suspect instrument automation will be something that develops broadly over the years.


I have made the case that measuring the variable properties of stars is a big data problem. The use of Splunk ITSI to treat each star as a service with KPIs makes the journey to discovery easier than past static techniques.

In my past Splunk blog entries covering astronomy, I mentioned people, who inspired me to create the entry. Throughout history, we know the familiar names of those who have discovered and enhanced our understanding of the Cosmos. But, for each well known scientific star, there may be hundreds that go unnoticed. I would like to take this opportunity to mention my uncle, retired optical engineer, Dr Pravin Mehta, as one of those, who were among the thousands, that contributed to the field as he had small parts for Skylab, Hubble, Chandra, and the Einstein X-Ray telescopes. It is the endeavors of people such as him that help illuminate our understanding of the universe.


Nimish Doshi
Posted by

Nimish Doshi

Nimish is Director, Technical Advisory for Industry Solutions providing strategic, prescriptive, and technical perspectives to Splunk's largest customers, particularly in the Financial Services Industry. He has been an active author of Splunk blog entries and Splunkbase apps for a number of years.

Show All Tags
Show Less Tags