Splunk Inc.

Cisco Technology, Inc.

Fang I Hsiao

Vladimir A Shcherbakov

Clayton S Ching

Tristan Antonio Fletcher

Michael R Dickey

Hemendra Singh Choudhary

Brian C Reyes

Nicholas Matthew Tankersley

Alan Vincent Hardin

Cary Glen Noel

Alok Anant Bhide

Ramkumar Chandrasekharan

Wei Jiang

Brian John Bingham

Brent Stephen Boe

Nishant Teredesai

Arun Ramani

Asmita Puri

Venkata Kuruvada

Clint Sharp

Kan Wu

David J Cavuto

Joshua H Mak

Ai-chi Lu

Alexander Lynn Raitz

Ian Matthew Link

Melanie Ann Garcia Alrajhi

Shruti Shrivastava

Disclosed embodiments receive an event stream from a remote capture agent. The event stream includes timestamped event data generated by the remote capture agent based on network traffic monitored by the remote capture agent. A graphical user interface (GUI) is caused to be displayed for obtaining configuration information for configuring the generation of time-series event data from network packets captured by the remote capture agent. A set of statistics is generated from the time-series event data, and the configuration information is updated to trigger subsequent storage and processing of at least a portion of the event stream by one or more components on a network based on one or more of the statistics, a storage limit associated with the time-series event data, an index volume of the event stream, a historical trend associated with the statistics, or input through the GUI.

Configuring generation of time-series event data from network packets captured by remote capture agent

A network storage volume stores a first entry in a first-mode storage bucket and a second entry in a second-mode storage bucket, the first-mode storage bucket having first bucket metadata, and the second-mode storage bucket having second bucket metadata. At least one bucket to be purged from the buckets of the network storage volume are selected based at least in part on bucket metadata of the plurality of buckets, where the buckets include the first-mode storage bucket and the second-mode storage bucket. The selected bucket is caused to be purged from the network storage volume.

Multi-modal data storage volume regulation

An example method of utilizing shared search queries for defining multiple key performance indicators (KPIs) comprises: receiving input specifying one or more service definitions, each service definition of the one or more service definitions specifying an entity definition for an entity providing a service of one or more services executing in an information technology (IT) environment, wherein the IT environment is monitored by the service monitoring system, wherein the service monitoring system uses first machine data of a first entity specified by a first service definition of the one or more service definitions to monitor a first KPI for a first service of the one or more services, and wherein the service monitoring system uses second machine data of a second entity specified by a second service definition of the one or more service definitions to monitor a second KPI for a second service of the one or more services; determining that the first machine data and the second machine data include common machine data; defining, based on the first machine data and the second machine data including common machine data, a shared base search query for the first KPI and the second KPI; executing the shared based search query to generated shared base search query results for the first KPI and the second KPI; and generating, using results from executing the shared base search query, a first value for the first KPI and a second value for the second KPI.

Utilizing shared search queries for defining multiple key performance indicators

Data intake and query system (DIQS) instances supporting applications including lower-tier, focused, work group oriented applications may be tailored to meet the specific needs of the users. Rather than offer pre-configured options, the DIQS-based application offers the user the ability to customize data collection before deploying the collectors for specified host entities within an IT environment. Once the user selects the metrics and/or log sources for data collection at a custom interface, the lower-tier DIQS generates custom script operable to establish collection of the source data having the selected metrics and events associated with selected log sources from the specified host entities. The user can display and analyze the collected data.

Information technology networked entity monitoring with metric selection

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements containing a set of statistics associated with one or more event streams that comprise the time-series event data. The system then causes for display, in the GUI, one or more graphs comprising one or more values from the set of statistics. Finally, the system causes for display, in the GUI, a value of a statistic from the set of statistics based on a position of a cursor over the one or more graphs.

Selective event stream data storage based on network traffic volume

The disclosed embodiments provide a system for extracting custom content from network packets. During operation, the system receives a stream of packets. The system then parses packets in the stream to determine a protocol for each packet. Next, the system applies a custom-content-extraction rule to each packet associated with a target protocol to obtain the extracted content. Then, the system stores the extracted content in events in a data store to facilitate subsequent queries involving the extracted content.

Generating event data at remote capture agents based on identified network addresses

Techniques and mechanisms are disclosed for generating visualizations which graphically depict network activity occurring between pairs of networked computing devices. The visualizations are based on data indicating the network activity, where the network activity can involve devices having any network addresses within an entire network address space (e.g., any address within the Internet Protocol version v4 (IPv4) or IPv6 network address space), or within some subset of an entire network address space. The ability to visualize high-level information related to network activity occurring across an entire network address space enables network analysts and other users to readily analyze characteristics of computer networks which otherwise might not be evident or difficult to obtain using other types of visualizations.

Animated visualizations of network activity across network address spaces

A service monitoring system executing on one or more processors may have operations that are determined by control information. Control over the operation of the service monitoring system can be exerted through the use of a graphical interface. The graphical interface may present the control information of a new or existing correlation search definition for user interaction. The service monitoring system may maintain a data store of key performance indicator (KPI) data, where a KPI value in the data store is produced by a KPI-defining search query that derives the value from machine data associated with one or more entities that perform a monitored service. A correlation search definition of the service monitoring system determines how a search of the KPI data is conducted, how its data is evaluated to determine whether a triggering condition has been met, and, if so, determines what triggered action is to be initiated.

Performance monitoring using correlation search with triggering conditions

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for managing one or more ephemeral event streams that contain temporarily generated time-series event data from the network packets, wherein managing the one or more ephemeral event streams comprises modifying an end time for terminating the capture of time-series event data in an ephemeral event stream. The system then updates the configuration information based on input received through the first set of user-interface elements.

Configuring event streams based on identified security risks

Information technology environment monitoring systems, for example, perform analytics over machine data received from networked entities. Outputs of such a system may be useful to help a user identify a problem and resolve an incident. Inventive aspects enable user interactions to trigger automatic connection with network servers to establish communication channels for conveying analytics and other information related to the problem between and among network nodes participating in the resolution of the problem or incident.

Collaborative incident management for networked computing systems

An automatic service monitor in an information-technology environment performs regular search queries against generated machine data to derive performance measurements. The information technology environment is defined in terms of services provided by entities, and the performance measurements are defined as key performance indicators (KPIs) of the services. Generated machine data used by the search queries pertain to the entities performing the service. Definitional information for the services, entities, and KPIs is administered by a user to control the operation of the service monitor. Various aspects of such definitional information as well as related performance measurement information may be presented in a unified console display tailored to, and organized around, a particular service. The console display may serve as a central launch point by supporting user interaction to navigate to other specialized monitoring interfaces.

Service detail monitoring console

A network storage volume stores first entries in a first-mode storage bucket and a second entries in a second-mode storage bucket. The first-mode storage bucket has first bucket metadata, and the second-mode storage bucket has second bucket metadata. A computer-implemented method includes comparing a utilized capacity of the network storage volume to a target capacity information of the network storage volume to obtain a comparison result. Based on the comparison result, at least one bucket is selected to be purged from the buckets of the network storage volume based at least in part on bucket metadata of the buckets. The method further includes causing a purge of the at least one selected bucket from the network storage volume.

Storage volume regulation for multi-modal machine data

An example method of implementing a monitoring interface for an information technology environment comprises: identifying machine data reflecting activity in the information technology environment comprising a plurality of entities providing a service; executing a search query to derive, from the machine data, a value of a key performance indicator (KPI) reflecting performance of the service; and causing display of a monitoring interface including: an identifier of the service, a color coded indication of a state of the KPI, and a visual representation of time series data associated with the service.

Monitoring interface for information technology environment

A method is disclosed that includes receiving a request to display a service-monitoring user interface that illustrates performance of one or more services that are each provided by one or more entities. Each service is associated with a stored service definition that identifies the one or more entities, and each entity is associated with stored entity definition information that identifies machine data produced by or about the entity from one or more sources. The method further includes causing display of the service-monitoring user interface illustrating performance of each service via an aggregate key performance indicator (KPI) that characterizes a respective service as a whole, and a plurality of aspect KPIs that each characterize an aspect of an associated service. Each KPI is defined by a search query that produces a value derived from the machine data identified by the entity definition information, the value indicative of a measure of the service at a point in time or during a period of time. The machine data is produced by one or more components within an information technology environment and reflects activity within the information technology environment.

Growing community of inventors

Berkeley, CA, United States of America

Fang I Hsiao