Splunk Inc.

Microsoft Technology Licensing, LLC

Glenn Block

Patrick Ogdin

Vishal Patel

Itay Alfred Neeman

Lin Ma

Mitch Blank

Henrik Frystyk Nielsen

Matthias Adam Leibmann

Michael Thomas McLean

Ladislau Conceicao

HongMei Ge

Alexander Corradini

Dean Shiyu Chiang

Randall Tombaugh

Ronald A Cain

Timothy Yu-Rui Chen

A data intake and query system processes and stores events, which are associated with token identifiers for tokens corresponding to data sources for the messages that the events are generated from. Thus, the data intake and query system can receive a request to provide analyses and visualizations regarding stored events associated with a particular component associated with a plurality of events, such as a data source for the messages from which the plurality of events are generated from. These requests and the resulting visualizations can be customized based on selected tokens and selected components.

Data source visualizations

Systems and methods for enabling cross-tenant access are provided. In particular, a computing device may receive an access request, from a user of a first tenant, requesting access to a resource of a plurality of resources on a shared collaborative channel of a second tenant. The computing device may further evaluate cross-tenant access policies of the first and second tenants to determine that access to the plurality of resources is authorized by the first and second tenants, validate that the user is a member of the shared collaborative channel, and generate a validation token indicating the user is validated to access the plurality of resources. Based on the validation token, the computing device may further validate that the user is in compliance with the cross-tenant access policies for accessing the resource and grant the user a set of permissions to access the resource.

Cross-tenant access to lightweight group assets

A data intake and query system receives raw machine via an internet protocol (IP) such as the hypertext transfer protocol (HTTP). The system has configurable global settings for the received raw machine data that determine properties such as the metadata that is associated with raw machine data. Each event is associated with a token, which is also configurable and provides settings such as metadata settings for the raw machine data. The raw machine data is stored as events based on the metadata. Electronic devices that generate raw machine data may transmit the raw machine data to the data intake and query system within HTTP messages. The HTTP messages may also include settings such as metadata for the raw machine data. The raw machine data is stored as events based on the global metadata settings, token metadata settings, and HTTP message metadata settings.

Tokenized HTTP event collector

A data intake and query system receives a message including raw machine via an internet protocol (IP) such as the hypertext transfer protocol (HTTP). The message includes a distinct payload portion and a distinct custom field portion. The payload portion includes raw machine data, while the custom field portion includes values for fields. An event that includes the raw machine data and the values is generated from the payload portion and the values are extracted from the custom field portion. The event is then stored such that the values are associated with the event.

HTTP events with custom fields

Data source metric visualizations

Data source tokens

Tokenized event collector

A data intake and query systems processes events received via the hypertext transfer protocol (HTTP). The HTTP events are associated with tokens. The received events are received by event collectors and distributed for storage. The data intake and query system receives requests to provide analyses and visualizations regarding the stored HTTP events. These requests can be customized based on selected tokens and selected data storage components. The visualizations are generated in response to the requests, and transmitted to the requesting device.

Analysis of tokenized HTTP event collector

Embodiments allow developers to use HTTP message abstractions inline within their Web API methods to directly access and manipulate HTTP request and response messages. A hosting layer is provided for in-process, in-memory and network-based services. Message handlers and operational handlers may be combined to create a message channel for asynchronous manipulations of the HTTP requests and response. A formatter may be used on the server or client for consuming HTTP and providing desired media types.

Web API framework

Growing community of inventors

Seattle, WA, United States of America

Glenn Block