Splunk Inc.

Erik M Swan

Stephen Phillip Sorkin

Robin Kumar Das

Michael Joseph Baum

Andre David Stechert

Rory Greene

Brian Philip Murphy

Nicholas Christian Mealy

R David Carasso

Bradley Hall

Christina Frances Regina Noren

David Carasso

Brad Hall

Nick Mealy

Christina Noren

Brian Phillip Murphy

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is stored as discrete events time stamps. A search is received and relevant event information is retrieved based in whole or in part on the time stamp, a keyword indexing mechanism, or statistical indices calculated at the time of the search.

Search phrase processing

Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.

Segmenting machine data into events to identify matching events

Segmenting machine data into events based on source signatures

Storing events derived from log data and performing a search on the events and data that is not log data

Time series search phrase processing

Determining time stamps in machine data derived events

Methods and apparatus are disclosed to automatically timestamp events within streaming machine data. The streaming machine data is broken into a set of events using breaking rules. Each event can be analyzed by iterating over own time stamp format patterns from a list of known time stamp format patterns to determine whether a matching pattern exists in the event. When an individual event broken out from the streaming machine data includes time information according to at least one known time stamp format pattern of the list of known time stamp format patterns, a timestamp can be created for the event by extracting a time value from event ng the matching pattern determined to exist in the event.

Determining timestamps to be associated with events in machine data

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.

Segmenting machine data using token-based signatures

Deriving signature-based rules for creating events from machine data

Applying time-based search phrases across event data

Identifying matching event data from disparate data sources

Identifying behavioral patterns of events derived from machine data that reveal historical behavior of an information technology environment

Analyzing machine data based on relationships between log data and network traffic data

Determining system behavior using event patterns in machine data

Identifying pattern relationships in machine data

Growing community of inventors

Piedmont, CA, United States of America

Erik M Swan