Latest version: 1.3.17


Visualize the numbers over time for each country, like "remaining patients sick or testing positive", or change to other metrics on the fly. Note the yaxis in this screenshot is logarithmic.   Next »
The same analysis can be done for some countries that have province/state level detail in the dataset. Here is the data for the US split by state, aligned to start at the date of each state's 30th case. Note this y-axis is linear.   Next »
Here is the same graph but with a logarithmic y-axis (note the yaxis numbers) Linear trends on log axis scales represent exponential growth in linear scale but for one thing the lines can be extrapolated more easily by the eye.   Next »
Here is the same pattern for China, split by China's provinces. Note how dominant Hubei province is   Next »
You can also see for each country selected at the top, a visualization showing total counts over time   Next »
You can now also analyze the United States by individual counties, although this data has only recently become available.   Next »

App Details

Latest version: 1.3.17
Last updated: August 2nd, 2020
First released: March 14th, 2020
CIM compliance: N/A

This free app is built to allow Splunk users to quickly and easily analyze and explore aspects of the CSSE data set about the COVID19 pandemic. (NOTE – it’s a “Splunk app” so you can only run it inside a much larger piece of software called “Splunk Enterprise.)

Initial inspiration was from an article at the Financial Times which they have continued to update. When I saw that chart I really wanted to have that in Splunk, to be able to run it every day with a new days worth of data, and to explore other charts like it, and to let anyone with a Splunk instance do any of that. So… this is me attempting to make that happen.

This app has already had many releases and been through many waves of improvements under the hood and you can read the release notes.

It is possible that I’ve made mistakes or inadvertently presented something in a misleading way although I am constantly checking for problems and fixing any I find. For detailed steps there is a page currently called “data onboarding notes”. You can reach me at

How to get the app

  • Download and install Splunk Enterprise from Splunk (if you haven’t already). It will come with a Trial license in it. It wont be very happy to run on a laptop but if it’s a decent laptop it can be done.
  • Next you must install our “Canary” and the “Sideview Utils” apps from Splunkbase. To do this you go to “Manage Apps”, then “Browse More Apps”, then you can search for those app names if you don’t see them on the first page. Click to install them. They won’t do anything or cause any trouble. It won’t earn you any email from us or from anyone else (Again feel free to email me though and I will happily write you back)
  • Next follow the same steps for the Covid19 app on Splunkbase. OR you can download the tar.gz from our website here.
  • (If you choose to download any tar.gz files instead of using Splunk’s “in-product” integration with their Splunkbase website, You can still install apps easily by going to “Manage Apps” and then clicking the button that says “Install App From File”. On the following page give it a tar.gz and that will get you there too.