Splunk Inc.

Eric Wohlstadter

Justin Pearson Smith

Steven Flanders

Gergely Danyi

Timothy Matthew Robin Williamson

Mayank Agarwal

Joseph Ari Ross

Steven Karis

Maxime Petazzoni

Chengyu Yang

Sahinaz Safari Sanjani

Sakshi Garg

Dmitrii Anoshin

Viet Quoc Nguyen

Umang Agarwal

Akila Balasubramanian

Vladimir Sor

Donald Passey

Henry Maier

An observability system is disclosed that provides novel techniques for configuring indexable custom tags. The observability system enables customers and users to specify and create indexable custom tags in a flexible and user-friendly manner. The observability system includes a novel custom tag configuration system that enables users of the observability system to configure indexed custom tags. Using a set of user interfaces (e.g., graphical user interfaces (GUIs)), a user is guided through a workflow for configuring indexed custom tags.

Custom indexed tags

A method of computing real-time metrics for automated workflows includes aggregating a set of ingested spans into a set of traces. The method further includes executing a set of rules to determine a set of workflows associated with the set of traces, wherein each workflow of the set of workflows is associated with a respective trace of the set of traces, and wherein each workflow is operable to group together activity associated with a client process within a respective trace. The method also includes assigning a name to each workflow based on the rules and computing real-time metrics for each of the workflows.

Configuring automated workflows for application performance monitoring

A computer-implemented method for analyzing spans and traces associated with a microservices-based application executing in a distributed computing environment comprises aggregating a plurality of ingested spans associated with one or more applications executing in the distributed computing environment into a plurality of traces, wherein each of the plurality of ingested spans is associated with a plurality of tags. The method further comprises comparing durations of a set of related traces of the plurality of traces to determine patterns for the plurality of tags and generating a histogram that represents a distribution of the durations of the set of related traces. The method also comprises providing alerts for one or more tags from the plurality of tags associated with traces having a duration above a threshold based on the distribution of the durations.

Configuring alerts for tags associated with high-latency and error spans for instrumented software

A method of identifying a root cause of a failure for a trace within a microservices-based application includes determining if a root span of the trace is an error span resulting in an error experienced by a user at a front end of the microservices-based application. If the root span of the trace is an error span, the method analyzes a plurality of spans comprising the trace to determine if the trace comprises at least one leaf error span. If the trace comprises a single leaf error span, the method attributes the root cause of the failure in the trace to a service associated with the single leaf error span. If the trace comprises multiple leaf error spans the method attributes the root cause of the failure in the trace to a service associated with a leaf error span of the multiple leaf error spans comprising a latest starting timestamp.

Identifying the root cause of failure observed in connection to a workflow

A method of analyzing a performance of a microservices-based application comprises generating a plurality of traces from a plurality of spans associated with the microservices-based application. The method also comprises generating a plurality of data sets each associated with a respective analysis mode of a plurality of analysis modes using the plurality of traces, wherein each analysis mode extracts a different level of detail for analyzing the performance of the services in the application from the plurality of spans. Further, the method comprises selecting, based on a first user query, a first analysis mode from the plurality of analysis modes for generating a response to the first user query. The method also comprises accessing a data set of the plurality of data sets that is associated with the first analysis mode and generating the response to the first user query using the data set associated with the first analysis mode.

Multiple modes of storing and querying trace data in a microservices-based architecture

Analyzing tags associated with high-latency and error spans for instrumented software

Multiple modes of data collection and analysis in a microservices-based architecture

Growing community of inventors

Atherton, CA, United States of America

Eric Wohlstadter