Splunk Inc.

Cisco Technology, Inc.

Abraham Starosta

Kristal Curtis

Francis Beckert

Poonam Yadav

Ram Sriharsha

Joseph Ari Ross

William Deaderick

Zhaohui Wang

Chandrima Sarkar

Om Rajyaguru

Alexander Sasha Stojanovic

Abhinav Mishra

Tanner Gilligan

Sichen Zhong

Julien Didier Jean Veron Vialard

Giovanni Mola

Vedant Dharnidharka

Robert Riachi

Implementations of this disclosure provide a search query statement generation system that receives user input being a natural language description of a search query and, through the use of artificial intelligence, translates the natural language description into an executable search query statement. The executable search query statement may be in the form of a pipelined search query statement. The use of artificial intelligence may include a trained machine learning model that transforms the natural language description to an alternative text format. In some instances, the trained machine learning model is a generative pre-trained transformer. In such instances, the natural language description may be provided to a chatbox, which may return one or more search query statements automatically generated by the generative pre-trained transformer. Further, one of the automatically generated search query statements may be executed such that the results are displayed within the chatbox.

Automated transformation of natural language queries into search query statements using artificial intelligence

Implementations of this disclosure provide a machine learning model training system that receives user input being a natural language description of a search query, and packages and transmits the natural language description as a prompt to a plurality of large learning models (LLMs). The model training system also receives response from the plurality of LLMs being translations of the natural language descriptions to an executable search query and displays the translations to a user via a graphical user interface. The model training system receives user feedback via the graphical user interface that corresponds to indications as to whether each translation is correct, syntactically and/or semantically, and, in some examples, an indication of which response was preferred. The model training system also generates training data from the user input, translations generated by the plurality of LLMs, and user feedback, and subsequently, initiates training of a LLM using the training data.

Machine learning model training data generation from generative artificial intelligence and user feedback

Implementations of this disclosure provide an anomaly detection system that automatically tunes parameters of a forecasting detector that detects anomalies in a metric time series. The anomaly detection system may implement a three-stage process where a first stage tunes a historical window parameter, a second stage tunes a current window parameter, and a third stage tunes the number of standard deviation different from historical mean required to trigger an alert. The tuned historical window length determined by the first stage may be provided to the second stage as input. Both the tuned historical window length and the tuned current window length may be provided to the third stage as input as use in determining the tuned number of standard deviations.

Automated determination of tuned parameters for analyzing observable metrics

A computerized method is disclosed for automated handling of data ingestion anomalies. The method features operations of detecting a data ingestion anomaly and determining a cause for the data ingestion anomaly. The causal determination may be conducted by at least (i) determining features of an anomalous data ingestion volume, (ii) training a second data model, after a first data model being used to detect the data ingestion anomaly, with data sets consistent with the determined features, (iii) applying the second data model to predict whether a data ingestion sub-volume is anomalous, (iv) obtaining system state information during ingestion of the anomalous data ingestion sub-volume, and (v) determining the cause of the anomalous data ingestion volume based on the system state information.

System and method for data ingestion, anomaly and root cause detection

A search assistant engine is described that integrates with a data intake and query system and provides an intuitive user interface to assist a user in searching and evaluating indexed event data. Additionally, the search assistant engine provides logic to intelligently provide data to the user through the user interface such as determining fields of events likely to be of interest based on determining a mutual information score for each field and determining groups of related fields based on determining a mutual information score for each field grouping. Some implementations utilize machine learning techniques in certain analyses such as when clustering events and determining an event templates for each cluster. Additionally, the search assistant engine may import terms or characters from user interaction into predetermined search query templates to generate tailored search query for the user.

Exploratory data analysis system for generation of wildcards within log templates through log clustering and analysis thereof

Implementations of this disclosure provide an anomaly detection system and methods of performing anomaly detection on a time-series dataset. The anomaly detection may include utilization of a forecasting machine learning algorithm to obtain a prediction of points of the dataset and comparing the predicted value of a point in the dataset with the actual value to determine an error value associated with that point. Additionally, the anomaly detection may include determination of a sensitivity threshold that impacts whether points within the dataset associated with certain error values are flagged as anomalies. The forecasting machine learning algorithm may implement a seasonality component determination process that accounts for seasonality or patterns in the dataset. A search query statement may be automatically generated through importing the sensitivity threshold into a predetermined search query statement that implements that forecasting machine learning algorithm.

Hyperparameter tuning for anomaly detection service implementing machine learning forecasting

Implementations of this disclosure provide a search assistant engine that integrates with a data intake and query system and provides an intuitive user interface to assist a user in searching and evaluating indexed event data. Additionally, the search assistant engine provides logic to intelligently provide data to the user through the user interface such as determining fields of events likely to be of interest based on determining a mutual information score for each field and determining groups of related fields based on determining a mutual information score for each field grouping. Some implementations utilize machine learning techniques in certain analyses such as when clustering events and determining an event templates for each cluster. Additionally, the search assistant engine may import terms or characters from user interaction into predetermined search query templates to generate tailored search query for the user.

Exploratory data analysis system for automated generation of search queries using machine learning techniques to identify certain log fields and correlation thereof

A computerized method is disclosed that includes operations of training a machine learning model using a labeled training set of data, wherein the machine learning model is configured to classify domain name server (DNS) records, obtaining DNS record data including at least a first DNS Txt record, applying the trained machine learning model to the first DNS Txt record to classify the first DNS Txt record and responsive to the classification of the first DNS Txt record, generating a flag for a system administrator. The trained machine learning model may classify the first DNS Txt record using logistic regression. In some instances, applying the trained machine learning model to the first DNS Txt record includes performing a tokenizing operation on the first DNS Txt record to generate a tokenized first DNS Txt record.

Systems and methods for DNS text classification

A computerized method is disclosed for automated handling of data ingestion anomalies. The method features training a data model based on a first volume of data associated with a first time period. Thereafter, using the data model, a predictive analysis is conducted on a second volume of data associated with a second time period subsequent to the first time period to produce a predicted data ingestion volume. After, a correlative analysis between the predicted data ingestion volume and an actual data ingestion volume during the second time period is conducted to produce a prediction error. A notification is generated based on the prediction error.

System and method for data ingestion, anomaly detection and notification

A computerized method is disclosed that includes operations of obtaining a data set, selecting candidate parameter pairs to be analyzed, wherein the candidate parameter pairs include a window length and a sensitivity multiplier, and wherein the window length is a number of data points, performing an anomaly detection process for each candidate parameter pair including importing each candidate parameter pair into a predetermined search query thereby generating a set of populated predetermined search queries, wherein the predetermined search query is configured to perform the anomaly detection process, executing each search query of the set of populated predetermined search queries on the data set to obtain a set of anomaly detection results, and scoring each anomaly detection result by applying a set of heuristics to the set of the anomaly detection results, and generating an auto-tuned search query by selecting a first candidate parameter pair based on a score of each of the set of anomaly detection results and importing the first candidate parameter pair into the predetermined search query.

System and method for automated determination of search query parameters for anomaly detection

Systems and methods are described for training an artificial intelligence model to extract one or more data fields from a log. For example, the artificial intelligence model may be a neural network. The neural network may be trained using training data obtained by iterating through a plurality of logs using active learning, and selecting a subset of the logs in the plurality to be labeled by a user. For example, the selected subset of logs may be logs that are not similar to other logs already labeled by a user. The user may be prompted to label the selected subset of logs to identify one or more data fields to extract. Once the selected subset of logs are labeled, these labeled logs can be used as the training data to train the neural network.

Growing community of inventors

Boston, MA, United States of America

Abraham Starosta