Splunking my Subaru: Putting Big Data in Gear for Turbocharged Insights
Growing up in an age where technology is booming has caused a great amount of interest for me into the latest and greatest tech. Not only have technology and computers come a long way in the past 30 years, but there have been great strides for technology in other areas, such as import cars and fuel-economy conservation. I mention these things to explain how Splunk is fitting into my life outside of work, combining both my passion of automobiles and technology. Gathering this data was a fun rush for sure, but being able to log the data points and use Splunk to actually get a look into what’s going on inside my car was priceless.
Why on Earth would I Splunk my Subaru?
After a few years of teetering on the idea of installing performance upgrades to my vehicle, and debating whether or not I’m too old to drive like I own a race car, I finally decided it was time to channel my inner Ricky Bobby/Dale Earnhardt/Cole Trickle. I wanted to add in some performance parts, but first I wanted to be able to collect some data around these upgrades. I came across a tech brief on a tool used specifically for my car. The Cobb Accessport is a tool used to troubleshoot computer-related issues in a vehicle or apply upgrades and edits to the computer software a car runs.

While the Accessport can do much more, realizing that it logs hundreds of data points from the vehicle to CSV format was definitely a highlight, seeing as Splunk can easily index CSV data. If you’re familiar with Splunk you know there is only one thing to do here: Splunk #allthethings! I wasn’t sure if these performance parts would really make my car perform that much better, and I didn’t know would kind of adverse effects there would be after me pulling pieces out of my engine and replacing them with aftermarket parts. I figured the best way to get to the bottom of this would be to stick to the facts and analyze the data using an awesome data analytics engine – Splunk.
Tuning my ride
To lay down some background information, I drive a 2015 Subaru WRX. Stock, it pushes 268 HP at 5600 RPM and 258 lb.-ft of torque from 2000-5200 RPM. If that doesn’t make sense to you, don’t worry. All you need to know is roughly the higher the numbers, the more power you’re going to get out of your car. The WRX comes stock with a turbo charger so that helps boost your power significantly more than a basic flat-four engine. I knew I wanted to make some specific upgrades to my car that dealt with both aesthetics (well, how my car sounded) and performance. I chose to make a few upgrades here:
- Cobb Big SF cold air intake
- Cobb Accessport Stage 1 Engine Control Unit (ECU) tune / Cobb Accessport Stage 1+ ECU tune
- Nameless 4” axelback exhaust
How I got my data
The Accessport logs data directly to a CSV file on the device itself. Using a micro usb to USB adapter, I was able to extract the CSV files using Cobb’s free Access Manager software. To avoid blinding myself with spreadsheets of thousands of numbers, I uploaded my data directly to Splunk with a monitoring statement. For more info on how to set that up, take a look at Splunk’s inputs.conf documentation.
Nothing too fancy was done to obtain this data (but I am working on running a Raspberry Pi from my center console to hopefully bring data in remotely from anywhere on the road – stay tuned for that!). Copying the data from the device to my Macbook sufficed here with a monitor statement. For demo purposes, I’ve left the sourcetype name as the pre-defined “csv” sourcetype and gave it an index.
Naturally, recording the data here was the most fun of all. Having a newborn son, it’s a little hard to get out of the house whenever I choose, so I spent my December mornings at 5AM logging 2nd gear pulls on the interstate on-ramp by my house. Like I said – the most fun of all.
Hearing what my car had to say
Enough of a description, let’s show you what my WRX data had to say. I made a few runs (datalogs) with a few different tunes set on my car. The standardized test I used is as follows:
- On a straight road, cruise at 2500 RPM in second gear.
- Enable data logging
- Open the throttle as fast as my foot can hit the floor until I redline (6700 RPM)
- Let off the throttle and disable data logging
I ran the same test in three different scenarios:
- Stock engine
- Stage 1 tune (a software update for the ECU)
- Stage 1+ tune (Stage 1 tune plus adjustments for the Cobb Big SF cold air intake
One of the most well-known measurements we will look at, yet usually misunderstood, is boost. Boost is measured as the difference between your engine’s air pressure and barometric pressure, measured in pounds per square inch (PSI) (engine air pressure absolute – barometric pressure absolute = boost level in PSI). For all readers that don’t live a double life as a meteorologist, barometric pressure is the pressure of the air outside of your car . At a very high level, the goal of a turbocharger is to boost the amount of air intake into the engine to allow the mixing of more fuel and air to increase combustion energy and *poof* you have more power thanks to forced induction. That said, more boost doesn’t always mean more power; there is a method to the madness. Running my engine stock showed a steady increase of boost as my RPMs increased thanks to my foot being glued to the floor. Stock was cool, but we want more power and we want it now! Running my car’s ECU at a Stage 1 tune allowed for that “boost” of boost we were looking for. The yellow line on the graph below shows what a simple Stage 1 adjustment can do. Relative to Stock, it felt like I was glued to the back of my bucket seat as it really woke up my car.

After installing the upgraded air intake system, I expected an even bigger upgrade in boost, especially seeing as my car was picking up speed way faster. Much to my surprise, we produced even less boost on average, but gained speed quicker, and topped out at a higher speed at the same RPM redline. Check out the numbers here where we only reach 52 MPH in 2nd gear running Stock where the BigSF intake tune took us to 60 MPH. While that might not sound like a big deal, it means a whole lot when you’re clocking a 0-60MPH time in a 6-speed transmission. The time saved having to up-shift to third gear alone is priceless.


The last measurement I was most interested in was the intake temperature of air in my engine. Let it be known that I was outside at 5AM in shorts mid-December running these exercises, so it was fairly cold, but all three runs were about the same temperature nonetheless. The Stage 1 and Stock tunes show an air intake temperature upwards of 50 degrees. I thought that 3 degrees might be a significant difference thanks to the ECU tune as my knowledge of auto mechanics isn’t as strong as my “0s and 1s” math, until I slapped the Cold Air intake on. I guess it makes sense why they call it “cold air” because the engine air temperature immediately dropped to 37 degrees from 54 – that’s a 30% difference from Stock! This is important because the colder the air injected into the engine, the more dense it is. The more dense the air, the more oxygen. The more oxygen an engine can breathe, the more chance for power gains – and we all know it’s all about the gains.

Spooling up for a Synopsis
Driving my car fast to pull this data was fun, but Splunking the data points and actually get a look into what’s going on inside my car was priceless. While I gained about 35 horsepower, there are plenty of modifications that can be made to cars or anything for that matter, where the seller claims it does “x, y, and z”. Using Splunk as a quality assurance tool (and just an overall awesome visualizer) for my performance upgrades has been not only helpful, but invaluable for looking historically at how these upgrades really benefited my car. In addition, this was extremely easy to set up on just my MacBook.
The performance gains have been great, my exhaust waking up my neighbors at 5AM on a cold start has allowed me an early morning chuckle, and getting data in was rather easy, but there’s always more to do. Stay tuned for the next blog on this subject where we’ll look at fuel-economy tunes vs performance tunes, along with using a Raspberry Pi to transmit engine data to Splunk in real-time.
About Hurricane Labs
Hurricane Labs is a dynamic Managed Services Provider that unlocks the potential of Splunk and security for diverse enterprises across the United States. With a dedicated, Splunk-focused team and an emphasis on humanity and collaboration, we provide the skills, resources, and results to help make our customers’ lives easier.
For more information, visit www.hurricanelabs.com and follow us on Twitter @hurricanelabs.
