Santa Claus International – a Splunk big data case study

Santa Claus International, and its other global brands such as Father Christmas, Kris Kringle, Saint Nicholas and Pere Noel are processing about 18 Elfabytes of data day in Splunk (An Elfabyte isn’t a vampire gnome but 1024 Zetabytes). They are using Splunk to improve CCE (Christmas Customer Experience), manage their gift operations and ensure timely deliveries of presents to over 2 billion children.


Whilst I was in the Nordics recently attending SplunkLive! Olso and Stockholm I had the opportunity to pop up to the North Pole and Lapland to interview Santa Claus International and talk to them about how they are using Splunk to get Operational Intelligence out of (very) big data.

Santa Claus International is facing a number of threats to their business. This includes competition from traditional sources such as Scrooge Ltd, Bah!Humbug Group but also new competition such as drone delivery of gifts from “the cloud”.

In light of this, Santa Claus International (SCI) are looking to differentiate themselves by measuring themselves on some key business KPIs including:

  • Ensuring the timeliness of deliveries
  • Accuracy of gifts vs. Christmas lists arriving from children
  • Correct prediction of naughty vs. nice children
  • Quality of gift construction, collation and packaging

You can see Santa Claus International working at full capacity in the image below:

Elf Operations

SCI have a number of data sources and considerable volumes of data to manage and get insight from. Some of their use cases for the data can be seen below

IT operational and application management data – SCI take their (Yule) log files from the entire organization and index it in Splunk. This includes their ERP (Enhanced Reindeer Planning) system, CRM (Christmas Readiness Management) application and their NOC (Noel Operations Centre). With over 2billion children to deliver to and an average of 3 gifts per child – Santa Claus International has a lot of gift processing to do. They have built their own cloud-based application that runs on Amazon AWS (Amazon Wrapping Service) and this data is also indexed in Splunk.

HoHoHoDoop – Santa Claus International have adopted Hadoop and customized it for their needs. This is known as HoHoHoDoop at SCI. They store approximately 10 Elfabytes of data relating to all the children they have ever delivered to, how successful the presents were received and a historical view of Christmas present stock)

Security information – to ensure Santa Claus International is secure from attacks from rogue elves, disenchanted reindeer and malicious employees of Scrooge Ltd and Bah!Humbug Group, SCI use Splunk to monitor real time attempts at DDOS (Distributed Dissing Of Santa) attacks and APTs (Awful Present Threats).

Sensor data and the Internet of Things – on their busiest day of the year (24th-25th December), Santa Claus International use Splunk to get real time, mission critical insight into how their key executive, Santa Claus, is performing. By taking sensor data from the collars of Dasher, Dancer, Prancer, Vixen, Comet, Cupid, Donder Blitzen and team leader Rudolph – SCI use their NOC to ensure that “Team Reindeer” are performing at optimum capacity. The NOC team, run by head elf, Will Ferrell, can also ensure that Santa Claus doesn’t consume too much brandy and doesn’t eat too many mince pies. In previous years, the added weight of this overconsumption has impacted “Team Reindeer” due to having to pull excessive bulk.

Digital Intelligence – in 2013, Santa Claus International launched their first online gift list service – GiftLink. This allows children to submit their letters through multiple channels. This digital behavior is being monitored by Splunk and is presented on a number of dashboards that enhance the CRM (Christmas Readiness Management) app. Any excessive present requests use Splunk alerts to ensure that these gifts are checked against the KPI around naughty vs. nice children. SCI are also planning to launch a new auction service to trade unwanted gifts, in the rare occasion that they make a mistake. This service will be called GiftBay or gBay for short.

Below is one of Santa Claus International’s dashboards (click to enlarge) presented in Splunk.

Christmas dashboard

On the right hand side it shows the UK starting to open their presents and the volume of presents opened vs. closed. On the left, Santa is still delivering to North America and you can see real-time insight into gifts delivered vs. gifts outstanding.

It was great to spend some time with one of our more secretive customers and see them gearing up for their busiest time of the year. Fingers crossed the festive period goes well for them and you all get the gifts you wanted…

b vHappy Christmas and Holiday from Splunk EMEA…



Posted by