Intermediate AirSim Splunk

Lab S05 — AirSim & Drone Data Integration with Splunk

Set up Unreal Engine and AirSim, write Python drone control scripts, collect UAV telemetry, and analyze it in Splunk with the Machine Learning Toolkit.

~2 hrs Windows 10 5 Sections
Part A Part B Part C
Progress
0 / 5

Prerequisites

1

Complete Lab S00 before starting this lab.

2

A Windows device is recommended but not strictly required for this lab.

3

AirSim requires a capable GPU for smooth simulation. Ensure your system meets the minimum graphics requirements before proceeding.

Introduction

Unreal Engine

Unreal Engine is a game development engine created in 1998. It has become one of the most widely used game engines and is now used for simulations, film, and AI research beyond gaming.

AirSim

AirSim is a virtual training environment created by Microsoft in 2017 to test AI research for autonomous vehicles. It runs as a plugin inside Unreal Engine and simulates multirotor drones and cars with realistic physics. This lab uses the CityEnviron simulation.

Part Overview
  • Part A: Install Epic Games Launcher, Unreal Engine 4.27.2, and AirSim CityEnviron
  • Part B: Set up Visual Studio Code, Python, and the drone control scripts
  • Part C: Collect flight telemetry and analyze it in Splunk MLTK

Part A — Unreal Engine & AirSim Setup

1

Install Epic Games Launcher from https://www.unrealengine.com. Download the .msi and install. Create or log into an Epic Games account.

Epic Games Launcher install
2

In the Epic Games Launcher navigate to Unreal Engine → Library. Install version 4.27.2 specifically.

Install Unreal Engine 4.27.2
3

Download AirSim CityEnviron — navigate to the AirSim GitHub releases page. Download both CityEnviron.zip.001 and CityEnviron.zip.002 one at a time (downloading simultaneously may cause errors).

4

Combine the split archives using 7-Zip (install from https://7-zip.org if needed). Highlight both files, right-click → Show More Options → 7-Zip → Extract Here.

7-Zip extract CityEnviron archives
5

Navigate into CityEnviron → WindowsNoEditor and launch CityEnviron.exe. When prompted select Quadrotor as the vehicle.

CityEnviron Quadrotor selection

Part B — Python & VS Code Setup

1

Install Visual Studio Code from https://code.visualstudio.com. Install the Python extension from the Extensions marketplace.

2

Create a new project folder in VS Code. To set up a Python virtual environment, open the Command Palette (Ctrl+Shift+P), select Python: Create Environment, choose Venv, then select your Python interpreter. VS Code will create and activate the environment automatically. Alternatively, select the interpreter from the bottom-right status bar.

3

Install dependencies:

pip install --upgrade pip pip install wheel pip install msgpack-rpc-python pip install airsim pip install matplotlib pip install keyboard pip install requests pip install pytz
4

Configure AirSim settings. Navigate to Documents\AirSim\settings.json and set SimMode to "Multirotor".

AirSim settings.json SimMode
5

Overview of the drone data script:

Script Functions
  • get_drone_data() — collects telemetry (position, velocity, GPS, battery state)
  • save_data_to_json() — writes data as JSON for Splunk ingestion
  • fly() — controls drone movement

The data() and fly() functions run concurrently via Python threading.

Drone data script overview

Part C — Data Collection & Splunk MLTK Analysis

1

In Splunk, install the Machine Learning Toolkit (MLTK) from Apps → Find More Apps. Create a new index for drone data.

2

Set up an HTTP Event Collector (HEC) under Settings → Data Inputs → HTTP Event Collector. Set sourcetype to _json. Note your token value.

HTTP Event Collector setup
3

Configure the data script — set your Splunk URL, HEC token, and index name in the drone_dat3.py file.

4

Launch CityEnviron (select Quadrotor). In VS Code run navigate2.py to take off, then run drone_dat3.py to start collecting telemetry. Fly for 1–2 hours at ~12 m/s at lamppost height to accumulate ~20,000 packets for meaningful MLTK analysis.

Drone flight data collection
5

In Splunk MLTK go to Search and run altitude analysis with anomaly detection:

index=Index_Name source=http:Event_Collector_Name sourcetype=_json | spath | spath path=GPS.altitude output=gps_alt | timechart span=1s avg(gps_alt) as avg_alt | anomalydetection avg_alt

And velocity (including all three axes) with anomaly detection:

index=Index_Name source=http:Event_Collector_Name sourcetype=_json | spath | spath path=Velocity.vx output=vx | spath path=Velocity.vy output=vy | spath path=Velocity.vz output=vz | timechart span=1s avg(vx) as avg_vx avg(vy) as avg_vy avg(vz) as avg_vz | anomalydetection avg_vx,avg_vy,avg_vz

MLTK uses these to establish a baseline of normal behavior and flag anomalous readings.

Splunk MLTK telemetry analysis