TIPS & TRICKS

Splunk and Sports

As I write this, the NBA Basketball playoffs are under way and some of you may be interested in what is currently happening with the sport. If you are a Splunk user, it may be worthwhile to take a break while you send a search to the background and get the latest playoff news and standings from Splunk Web itself. To meet that objective, I’ve created a simple XML dashboard which shows the latest RSS headlines from NBA.com and ESPN in 2 different panels with their respective web pages in iFrames. In this manner, I can do my Splunk work and also jump to this basketball app to catch up with what is going on in the NBA. Here’s a snapshot of the app.

Basketball RSS Feed

You get the title and description of the news item and access to its corresponding web page right in the same dashboard. (This was built using previous work I had done with indexing RSS feeds and using Splunk as a RSS reader.) If you scroll down, you will see more RSS feed events and another corresponding web page. You can download this app from Splunkbase and have it running in your Splunk server in no time. Since the interval to collect RSS data is set to 1 day, very little data is collected. You can change that interval in the app to be less time, if needed. The other feature is that you can click on a title and get to the raw news event in Splunk. By using the field picker to select the link field, you can then use the pull down menu item “Read Article” to read the news article itself.

Get Article

Now, you may be saying that you can always simply go to a web site and use your favorite RSS reader to do similar things. However, what is happening here is that the time stamp, title, description, and link to the article is being indexed on a daily basis. What this means is that you now have a historical, searchable index for all your feeds. If your favorite player is Kobe, you can simply perform a search for “sourcetype=rssfeed Kobe” for say, the last 7 days, and get a weeks worth of articles on Kobe. An experienced Splunk user may even remove duplicates with this simple search:

sourcetype=rssfeed title=*Kobe*|dedup title

Enjoy using the app.

Other Sports

You may be wondering about other sports. I’ve created similar apps with the same 2 panel headlines and 2 embedded pages for other sports for you to download from Splunkbase.

International

Some of our international readers will rightfully observe that this is all about American sports. To that end, I confess that I do not know much about international sports in terms of following teams from all over the world, but I did manage to create a soccer app, (pronounced “fuutball” outside of the USA) that has the same features as the other apps listed above. You may also download the soccer headlines and web pages app from Splunkbase.

Nimish Doshi
Posted by

Nimish Doshi

Nimish is Director, Technical Advisory for Industry Solutions providing strategic, prescriptive, and technical perspectives to Splunk's largest customers, particularly in the Financial Services Industry. He has been an active author of Splunk blog entries and Splunkbase apps for a number of years.