Splunk Inc.

Splunk He.

Isabelle Park

Simon Foster Fishel

Eric Nathaniel Tschetter

Joshua Walters

Joerg Beringer

Cary Glen Noel

Vivian Shen

Akash Dwivedi

Horst Werner

Jindrich Dinga

Vishal Patel

Amritpal Singh Bath

Jiahan Wang

Tingjin Xu

Samat Jain

Jibang Liu

Shanmugam Kailasam

Felix Jiang

Divya Vijayan

Keith Kramer

Paul Boster

Mei Chun Yeh

Elizabeth Li

Chandrashekar Basavaiah

Systems and methods are disclosed for providing a multi-component application, including a first and second component, and a first and second server. The first component may be implemented at the first server, while a second component may be implemented at a client device. An end user of a client device may request access to metadata stored on the second server that is utilized by the second component to implement the multi-component application. The end user may authenticate with the first component. The first component may then communicate with the second server to authenticate the end user to the second server, thereby granting the end user access to the second server without having to reauthenticate to the second server.

Enabling pass-through authentication in a multi-component application

Multiple storage system event handling includes obtaining multiple events for storage on multiple storage systems. For each of the multiple events, field values from each event are extracted. The field values are matched to configurations of the storage systems to identify a subset of the storage system having a matching configuration. The event is transmitted to the subset. The multiple events are transmitted to heterogeneous subsets.

Multiple storage system event handling

Ingest health monitoring includes receiving an event stream of events in a data intake and query system to store on at least one storage system and obtaining an event from the event stream. Ingest health monitoring further includes transmitting the event to a selected ingest module queue for the event, updating an output rate indicator counter for the selected ingest module queue when failure to store the event in the ingest module queue occurs, obtaining the event from the selected ingest module queue, processing the event to generate a file for the event, and transmitting the file to the at least one storage system. Ingest health monitoring further includes updating the write failure indicator counter for a storage system of the at least one storage system when failure to transmit to the storage system occurs and updating the user interface based on the output rate indicator counter and the write failure indicator counter.

Ingest health monitoring

Systems, methods, and computer readable media are disclosed for generating and providing concurrent journey visualizations associated with different journey definitions. In computer-implemented embodiments, a data intake and query system, or a journey visualization computing tool, can be used to generate and provide concurrent representations corresponding with different journey definitions. In operation, a set of journey instances associated with a journey having a set of steps is obtained. Each step may be associated with at least one event that includes raw machine data produced by a component of an information technology environment. Upon obtaining different journey definitions specifying filters to apply to the set of journey instances, the data intake and query system can generate journey visualizations in accordance with the journey definitions. Thereafter, the journey visualizations corresponding with the journey definitions can be concurrently displayed by a computing device via a graphical user interface.

Generating new visualizations based on prior journey definitions

Systems and methods are disclosed for implementing a data stream correlation user interface. The data stream correlation user interface enables users to view information from two sets of records, and identify fields in the two sets of records that can be matched together to 'glue' together multiple records. For example, a user may specify that values in an 'AcctID' field in one set of records can be matched to values in an 'Account_ID' field of a second set of records. Additional identifying fields may be selected, such that multiple values can be chained together. The system can match the records of multiple sets together using designated fields, enabling users to view how many records from one set have a corresponding record in another set.

Data source correlation user interface

Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be easily and rapidly modified by modification to the first component, without requiring modification to the second component. The first component may be implemented locally at a client device, while the second component is implemented remotely. While modification of the second component may require privileges of a remote location, a user of a client device may modify the first component while maintaining interoperability and compatibility with the second component, thereby enabling the end user to modify functionality of the multi-component application. In some instances, different versions of a first component are provided, and an end user of a client device is enabled to specify which version of the first component should be used.

Enabling agile functionality updates using multi-component application

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

Relating events and matching events to steps of a process using field values from different fields

Systems and methods are disclosed for cross-system journey modeling based on relation of machine data. An example method includes obtaining information describing a user journey that includes multiple steps, each step corresponding to a query to be applied to one or more field-searchable data stores storing events, each event including a portion of machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment, and each event being associated with a timestamp extracted from the portion of machine data of that event. Events returned as a result of the query of each step are related. The results of the relating are displayed.

Cross-system journey monitoring based on relation of machine data

Journey instance generation based on one or more pivot identifiers and one or more step identifiers

An integrated data analytics tool is described that enables users to efficiently create and communicate data analysis flows or storylines. The data analytics tool includes graphical user interfaces (GUIs) that enable users to create data analysis 'pipelines' that serve as both a visual and technical representation of a data analysis flow. Among other features, a data analysis pipeline enables users to easily add and link related data visualizations in a pipeline, to update datasets and filters associated with data visualizations in a pipeline and to have those updates be propagated automatically to other visualizations in the pipeline, and to create side-by-side comparisons of visualizations based on different datasets/filters. Users presented with such data visualization pipelines can also interact with the visualizations and dynamically update a displayed analysis by selecting different datasets, filters, pipeline paths, and so forth.

Creating and communicating data analyses using data visualization pipelines

Systems and methods are disclosed for efficiently detecting alert states within unstructured event data. Alert states are illustratively defined as occurring when a threshold number of journey instances are present within the unstructured event data, each journey instance representing a series of events within the event data representing steps within a pre-defined journey. Detecting journey instances within unstructured event data can require significant computational resources, and thus attempting to detect alert states directly from unstructured event data can lead to inefficiencies. Embodiments of this disclosure enable a structured data set of journey instances to be generated from unstructured event data, and for the structured data set to be evaluated based on criteria of multiple alert states. By utilizing a single structured data set to support evaluation based on multiple alert states, detecting alert states from unstructured event data is rendered more efficient.

Efficient detection of alert states within unstructured event data based on evaluation of structured data set

Generating and providing concurrent journey visualizations associated with different journey definitions

Systems and methods are disclosed for implementing a data stream correlation user interface. The data stream correlation user interface provides workflows for selecting individual data sources from a matrix of data sources, identifying individual data fields of the data sources, establishing criteria for determining correlations between them, and reviewing and enabling user verification of correlated data sources. Correlations may be established based on the values of data fields in individual records of the data sources, and may be determined based on correspondences or associations between the values, lookup tables, formulas, user-specified criteria, or other relationships.

Growing community of inventors

San Mateo, CA, United States of America

Isabelle Park