The Met Office Weather Forecast Add-on allows you to pull weather data from the Met Office Into Splunk. The Add-on pulls hourly forecast data for a given latitude and longitude.

Met Office DataHub API

The Add-on uses the Met Office DataHub API. In order to use the Add-on you must:

  • Create an account
  • Register an App
  • Subscribe the App to the Basic (free) Plan

This should only take around 5 minutes to setup. The output of this process is that you will receive a client_id and client_secret which you will use in the Add-on setup.

Add-on Installation

The Add-on can be installed direct from Splunkbase or by downloading the archive (.spl) file and installing in the normal manner, either through the Splunk Web GUI or at the command line.

Add-on Configuration

Open the Add-on and click on “Configuration” and then “Add-on Settings”. Enter the Client ID and Client Secret supplied by the Met Office.

add-on configuration screen
Add-on Configuration – Client ID and Client Secret

Next click on Inputs in the menu bar to setup the API call. In order to setup an Input you will need to know the latitude and longitude of the location you wish to retrieve weather forecast data for. Some suggested locations are shown below:

iDelta Office, Edinburgh 55.95529-3.19442
Old Course, St. Andrews56.34566-2.80889
Splunk HQ, San Francisco37.767-122.396
Potential Locations that can be used
  • Click on “Create New Input”
  • Set the Name to match the location, e.g. OldCourse
  • Enter the interval – how often to retrieve the data, 3600 seconds is a suitable value. Collecting too frequently will hit the API limits of the basic subscription with the Met Office and result in API call fails
  • Index – set the index to store the data in
  • Enter Latitude – enter the latitude of the location to retrieve data for
  • Enter Longitude – enter the longitude of the location to retrieve the data for
  • Click Add

Note that multiple Inputs can be created to retrieve weather forecast data for multiple locations.

Inputs Configuration Screen

Searching Data

The data can now be searched. The basic search is as follows:

index=main sourcetype="metoffice:datahub:hourly"

Note that the Input Name defined earlier becomes the last part of the source field, allowing searches to be easily created over specific locations.

Note that this is a forecast – so there are timestamps in the future. Adding the time modifiers “earliest=now latest=+24h” sets the time range to be from now to +1 day in the future.

Using this we can easily create timecharts that plot the temperature for the next 24h. We can see here that it will be warmer in San Francisco than it will be on the Old Course in St. Andrews.

Temperature comparison of San Francisco and The Old Course, St. Andrews for the next 24h

The following search was used for this timechart:

index=main sourcetype="metoffice:datahub:hourly" earliest=now latest=+24h
| rex field=source "datahub_hourly://(?<location>\w+)"
|timechart max(feelsLikeTemperature) span=1h by location


This add-on has been created as part of a series of Add-ons dealing with energy monitoring. Knowing the temperature at a given location will be a useful input into analytics around energy usage for heating.

It was built using the Splunk Add-on Builder. Various issues were encountered when trying to develop and run the Add-on on a Mac install of Splunk, no issues encountered when running the Splunk server on a Linux VM.

Splunkbase Listing

Add-on for Met Office DataHub on Splunkbase

Posted by:Stuart Robertson

Stuart Robertson is the Consulting Director at iDelta. He is one of the initial founders of iDelta and has worked there since formation in 2001. Stuart holds various certifications in Core Splunk and ITSI. Stuart also holds a Bsc(Hons) in Computing Science from the University of Glasgow.