Splunk Inc.

Splunkinc.

Alexander William Cruise

Byron Jason Shelden

Claire Alexandria Tanner Semple

Daniel Ferstay

Systems and methods are disclosed for implementing a low-latency data stream monitoring system. The data stream monitoring system may obtain raw data from a data source as soon after the data is generated, and may classify the data according to different topics. The topics may be published in a publish-subscribe messaging model, and data enrichment systems may subscribe to the topics to receive data for enrichment. The data enrichment systems may supplement or replace the raw data with additional information, and may further classify or reclassify the enriched data into different topics. The enriched data may then be published to an alert generation system, which may apply various criteria to the enriched data to determine that alerts should be generated, generate the alerts, and publish or transmit the alerts to client devices. Individual data streams, topics, enrichments, criteria, and alarms may be added, removed, or modified as required.

Low-latency streaming analytics

A computerized method is disclosed that includes operations of receiving one or more records, wherein each of the one or more records indicates a successful search query evaluation by at least one of a plurality edge devices, building a predictive analytics model based on the one or more records, wherein the predicative analytics model is configured to perform operations configured to predict enrichment data that is to be needed by one or more edge devices in the future during evaluation of a future search query, performing predictive analytics using the predictive analytics model to determine predictive enrichment data, and transmitting a first response packet to a first edge device, wherein the first response packet includes the predictive enrichment data. The records may include one or more of a data stream identifier, a search query, enrichment data that was required at a time the search query was evaluated.

System and method of generation of a predictive analytics model and performance of centralized analytics therewith

The computerized method is shown and includes obtaining input at a local electronic device, generating a first result by processing the input according to a first rule set, wherein the first result provides a current status or a predicted status of the electronic device and transmitting the first result or indicia thereof to a remote server computer system. The computerized method additionally includes receiving a communication from the remote server computer system, wherein the communication includes an instruction to enable a second rule set, responsive to receiving the communication, enabling the second rule set, obtaining subsequent input at the local electronic device, and processing the subsequent input according to the second rule set. The computerized method may further include performing a statistical analysis on the input, and generating a predicated status of the electronic device based on an extrapolation process using a result of the statistical analysis.

Analytics for edge devices to intelligently throttle data reporting

A computerized method is shown and includes receiving one or more lists of identifiers, generating a batch query from the one or more lists of identifiers, querying one or more data stores using the batch query, generating one or more response packets including results from querying using the batch query, and transmitting a first response packet to a first edge device. Generating the batch query may be performed by merging a plurality of lists of identifiers to form a merged list, and removing duplicate identifiers from the merged list. Further, the first response packet may be generated for the first edge device and includes enrichment data corresponding to identifiers transmitted by the first edge device. Additionally, may be the first response packet is generated for a plurality of edge devices including the first edge device and includes enrichment data corresponding to identifiers transmitted by the plurality of edge device.

System and method for centralized analytics through provision of enrichment data to an edge device

The computerized method is shown and includes obtaining input from a data stream at an electronic device, wherein the input includes machine data, wherein the electronic device has stored thereon a first query, evaluating the query by processing the input according to the first query, responsive to detecting a failure during evaluation of the query resulting from a lack of enrichment data stored on the electronic device, recording a first identifier corresponding to the enrichment data, transmitting the first identifier to a remote server computer system, receiving a communication from the remote server computer system, wherein the communication includes the enrichment data, and evaluating the query by processing second input from the data stream according to the first query and the enrichment data. In some instances the enrichment data includes contextual information for parsing the data stream and converting extracted data into an alternative format.

Growing community of inventors

Vancouver, Canada

Alexander William Cruise