National Public Radio NPR                                              24/7Sondra Russell, Senior Digital Analystsrussell@...
Audio and Video Tracking: The Basic Setup           MP3 Downloads       ProgramID                               (?P<Progra...
“How Has my Podcast Been Doing?”> index=“summary” search_name=“si_download_programID” ProgramName=“Planet Money”          ...
“How Are People Accessing Our Show?” > * | eval Platform = mvfilter(match(eventtype,"plat*")) | timechart span=1w count by...
The SoundExchange Problem   > transaction IPAddress startswith="play" endswith="stop" | concurrency duration=duration | ev...
“What Percentage of our Users Have Upgraded?” > * | rex field=_raw "Darwin/(?<Version>[0-9.]*)"“ | top Version      Uses r...
“Splunk + API Logging = Major Win for the API”Sondra Russell, Senior Digital Analystsrussell@npr.org
“Which Stories are Getting Tweeted the Most?” >   index=“twitter” | stats count by story_url   timestamp="2011-07-        ...
Upcoming SlideShare
Loading in …5
×

Splunk at opa

495 views

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
495
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
17
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Splunk at opa

  1. 1. National Public Radio NPR 24/7Sondra Russell, Senior Digital Analystsrussell@npr.org
  2. 2. Audio and Video Tracking: The Basic Setup MP3 Downloads ProgramID (?P<ProgramID>[^/]*)(?=/ Podcast Download On Demand Flash ) sourcetype = 08/08/2011=>31800 download AND 08/09/2011=>29655 Live Streams UserAgent status < 300 AND 08/10/2011=>29903 (?P<UserAgent>[^"]*)(?=" Method=Get | 08/11/2011=>53443 ) transaction 08/12/2011=>32593 AppVersion IPAddress UserAgent 08/13/2011=>88654 “*(? =/)” maxspan=120… 08/14/2011=>11231 1 Ingest 2 Extract 3 Define 4 Create Raw Data Fields Transactions Summary IndexesSondra Russell, Senior Digital Analystsrussell@npr.org
  3. 3. “How Has my Podcast Been Doing?”> index=“summary” search_name=“si_download_programID” ProgramName=“Planet Money” Pulls from the summary index Pulls from lookup table mapping programID to programNameSondra Russell, Senior Digital Analystsrussell@npr.org
  4. 4. “How Are People Accessing Our Show?” > * | eval Platform = mvfilter(match(eventtype,"plat*")) | timechart span=1w count by Platform Filters data for specific event types plat_iphone_browser UserAgent="*iPhone*" AND UserAgent!="*NPRRadio*" AND UserAgent!="*iPod*“ AND sc!=18Sondra Russell, Senior Digital Analystsrussell@npr.org
  5. 5. The SoundExchange Problem > transaction IPAddress startswith="play" endswith="stop" | concurrency duration=duration | eval key=1 | lookup songs key | stats first(song) as song max(concurrency) as concurrency by id | stats sum(concurrency) by songSondra Russell, Senior Digital Analystsrussell@npr.org
  6. 6. “What Percentage of our Users Have Upgraded?” > * | rex field=_raw "Darwin/(?<Version>[0-9.]*)"“ | top Version Uses regex to extract element from "NPRMusic/2.7 CFNetwork/459 Darwin/10.0.0d3" raw dataSondra Russell, Senior Digital Analystsrussell@npr.org
  7. 7. “Splunk + API Logging = Major Win for the API”Sondra Russell, Senior Digital Analystsrussell@npr.org
  8. 8. “Which Stories are Getting Tweeted the Most?” > index=“twitter” | stats count by story_url timestamp="2011-07- 18T15:40:34Z", author="drpdtapp (Dr. P. D Tapp)", tweet="Tinnitus: Why Wont My Ears Stop Creates reports from a custom log Ringing?”, story_url="http://www.npr.org/2011/07/18/ 138163304/tinnitus-why-wont-my-ears-stop- ringing?sc=tw",Sondra Russell, Senior Digital Analystsrussell@npr.org

×