Splunk Inc.

Eric Nathaniel Tschetter

Joshua Walters

Simon Foster Fishel

Isabelle Park

Akash Dwivedi

Joerg Beringer

Tristan Antonio Fletcher

Ross Andrew Lazerowitz

William Marcum

Michael Margulis

Vivian Shen

Amy Katherine Hunnel Bianchi

Elizabeth Li

Chandrashekar Basavaiah

Alexandros Nikolaos Kompotis

Caleb Eugene Hanson

Sean David McBride

Daniel Blake Partain

Dipti Prabhakar Siddamsettiwar

Daniel M Jones

Himanshu Gupta

Cary Glen Noel

Horst Werner

Jindrich Dinga

Mei Chun Yeh

Rahul Gidwani

Systems and methods are disclosed for providing a multi-component application, including a first and second component, and a first and second server. The first component may be implemented at the first server, while a second component may be implemented at a client device. An end user of a client device may request access to metadata stored on the second server that is utilized by the second component to implement the multi-component application. The end user may authenticate with the first component. The first component may then communicate with the second server to authenticate the end user to the second server, thereby granting the end user access to the second server without having to reauthenticate to the second server.

Enabling pass-through authentication in a multi-component application

Systems and methods are disclosed for supporting transformations of a graph generated from a query to event data. The event data may be unstructured event data, from which instances of a journey can be identified that represent sequences of related events describing actions performed in a computing environment. When evaluating journey instances, it can be helpful to visualize the instances as a graph. Depending on the instances viewed, a user may desire different modifications to the graph. While such modifications can be made when initially building instances from the unstructured event data, this can limit reuse of the resulting instances (since the modification would also be present when evaluating other subsets). To address this, embodiments of the present disclosure enable graph modifications to be applied to subsets of journey instances after building those instances from unstructured event data, increasing reuse of instances built from a query against the unstructured data.

Supporting graph data structure transformations in graphs generated from a query to event data

Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be easily and rapidly modified by modification to the first component, without requiring modification to the second component. The first component may be implemented locally at a client device, while the second component is implemented remotely. While modification of the second component may require privileges of a remote location, a user of a client device may modify the first component while maintaining interoperability and compatibility with the second component, thereby enabling the end user to modify functionality of the multi-component application. In some instances, different versions of a first component are provided, and an end user of a client device is enabled to specify which version of the first component should be used.

Enabling agile functionality updates using multi-component application

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

Relating events and matching events to steps of a process using field values from different fields

Systems and methods are disclosed for efficiently uploading event data of a data intake and processing system and building journey instances using the uploaded event data in a distributed manner. Each journey instance is illustratively associated with a series of events within the event data occurring over a journey duration. For example, a cloud-based hosting system can implement a cloud-based distributed system that receives fragmented uploads of event data from the data intake and query system. Once received, the cloud-based hosting system can combine the event data from one or more uploads and re-stitch portions of the uploaded event data using a set of worker nodes to build journey instances.

Fragmented upload and re-stitching of journey instances detected within event data

Systems and methods are disclosed for efficiently storing information identifying journey instances within unstructured event data of a data intake and processing system. Each journey instance is illustratively associated with a series of events within the unstructured event data occurring over a journey duration. Because the unstructured event data may be constantly updated, any given inspection of the event data may yield both complete and incomplete instances. Storage of instance data over time can require updating of prior incomplete journey instances with complete versions of such instance detected at a later point in time. However, a data store of the unstructured event data may be unsuited for such updating, as the store may maintain version information for deleted data to reduce possibility of data loss. To address this issue, a separate structured data store, such as a columnar time series data store, is provided to efficiently store instance information.

Efficient updating of journey instances detected within unstructured event data

An application executing on a mobile computing platform provides independent data channels over a mobile network to multiple separate computing systems that each maintain some data pertinent to problem determination and resolution when an incident arises in a monitored information technology (IT) environment. The application maintains and separately exercises the channels to provide timely information in a user interface that composites data to present a single interface with a multi-sourced contextual rendering. Some systems may include an IT monitoring system and a separate incident management system among its sources. Channels may include extended functionality to improve security or other aspects of communication with mobile platforms.

Composite display of multi-sourced IT incident related information

Journey instance generation based on one or more pivot identifiers and one or more step identifiers

Multi-source incident management and monitoring system

Systems and methods are disclosed for efficiently detecting alert states within unstructured event data. Alert states are illustratively defined as occurring when a threshold number of journey instances are present within the unstructured event data, each journey instance representing a series of events within the event data representing steps within a pre-defined journey. Detecting journey instances within unstructured event data can require significant computational resources, and thus attempting to detect alert states directly from unstructured event data can lead to inefficiencies. Embodiments of this disclosure enable a structured data set of journey instances to be generated from unstructured event data, and for the structured data set to be evaluated based on criteria of multiple alert states. By utilizing a single structured data set to support evaluation based on multiple alert states, detecting alert states from unstructured event data is rendered more efficient.

Efficient detection of alert states within unstructured event data based on evaluation of structured data set

Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be modified by modification of the first component, potentially without requiring modification of the second component. However, some functionalities added to application may require modifications to both the first and second component. To maintain compatibility between components, the first component can be configured to detect versioning information of a second component, and adjust its functionality to disable functions unavailable due to lack of compatibility with a current version of the second component. The first component can notify an end user of any such lack of compatibility, and potentially instruct the end user in updating the second component.

Maintaining compatibility in a multi-component application

Growing community of inventors

Redwood City, CA, United States of America

Eric Nathaniel Tschetter