Splunk Inc.

Other

Splunkinc.

Jacob Barton Leverich

Adam Jamison Oliner

Manish Sainani

Hongyang Zhang

Alex Cruise

Shang Cai

Mihai Ganea

Leonid Alekseyev

Sonal Maheshwari

Jesse Brandau Miller

Alok Anant Bhide

Brian C Reyes

Alan Vincent Hardin

Iman Makaremi

Nghi Huu Nguyen

Sergey Slepian

Di Lu

Steve Yu Zhang

Iryna Vogler-Ivashchanka

Jindrich Dinga

Katherine Kyle Feeney

Lin Ma

Yuan Xie

Toufic Boubez

Jonathan La

Colleen Kinross

Marc Vincent Robichaud

Cory Eugene Burke

Jeffrey Thomas Lloyd

Zidong Yang

Systems and methods include causing presentation of a first cluster in association with an event of the first cluster, the first cluster from a first set of clusters of events. Each event includes a time stamp and event data. Based on the presentation of the first cluster, an extraction rule corresponding to the event of the first cluster is received from a user. Similarities in the event data between the events are determined based on the received extraction rule. The events are grouped into a second set of clusters based on the determined similarities. Presentation is caused of a second cluster in association with an event of the second cluster, where the second cluster is from the second set of clusters.

Supplementing extraction rules based on event clustering

A continuous anomaly detection service receives data stream and performs continuous anomaly detection on the incoming data streams. This continuous anomaly detection is performed based on anomaly detection definitions, which define a signal used for anomaly detection and an anomaly detection configuration. These anomaly detection definitions can be modified, such that continuous anomaly detection continues to be performed for the data stream and the signal, based on the new anomaly detection definition.

Anomaly detection from incoming data from a data stream

Embodiments of the present invention are directed to facilitating data preprocessing for machine learning. In accordance with aspects of the present disclosure, a training set of data is accessed. A preprocessing query specifying a set of preprocessing parameter values that indicate a manner in which to preprocess the training set of data is received. Based on the preprocessing query, a preprocessing operation is performed to preprocess the training set of data in accordance with the set of preprocessing parameter values to obtain a set of preprocessed data. The set of preprocessed data can be provided for presentation as a preview. Based on an acceptance of the set of preprocessed data, the set of preprocessed data is used to train a machine learning model that can be subsequently used to predict data.

Data processing for machine learning using a graphical user interface

Techniques are disclosed for anomaly detection based on a predicted value. A search query can be executed over a period of time to produce values for a key performance indicator (KPI), the search query defining the KPI and deriving a value indicative of the performance of a service at a point in time or during a period of time, the value derived from machine data pertaining to one or more entities that provide the service. A graphical user interface (GUI) enabling a user to indicate a sensitivity setting can be displayed. A user input indicating the sensitivity setting can be received via the GUI. Zero or more of the values as anomalies can be identified in consideration of the sensitivity setting indicated by the user input.

Detecting anomalies in key performance indicator values

Methods and systems for determining event probabilities and anomalous events are provided. In one implementation, a method includes: receiving source data, where the source data is configured as a plurality of events with associated timestamps; searching the source data, where the searching provides a search result including N events from the plurality of events, where N is an integer greater than one, where each event of the N events includes a plurality of field values, where at least one event of the N events can include one or more categorical field values and one or more numerical field values; and for an event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities determined for the plurality of field values, determining a probability of occurrence for the event.

Graphical user interface indicating anomalous events

Embodiments of the present invention are directed to facilitating distributed data processing for machine learning. In accordance with aspects of the present disclosure, a set of commands in a query to process at an external computing service is identified. For each command in the set of commands, at least one compute unit including at least one operation to perform at the external computing service is identified. Each of the at least one compute unit associated with each command is analyzed to identify an optimized manner in which to execute the set of commands at the external computing service. An indication of the optimized manner in which to execute the set of commands and a corresponding set of data is provided to the external computing service to utilize for executing the set of commands at the external computing service.

Efficient command execution using aggregated compute units

Systems and methods include obtaining a set of events, each event in the set of events comprising a time-stamped portion of raw machine data, the raw machine data produced by one or more components within an information technology or security environment and reflects activity within the information technology or security environment. Thereafter, a first neural network is used to automatically identify variable text to extract as a field from the set of events. An indication of the variable text is provided as a field extraction recommendation, for example, to a user device for presentation to a user.

Providing field extraction recommendations for display

Anomaly detection for data stream processing

Clustering events while excluding extracted values

In some implementations, sequences of time series values determined from machine data are obtained. Each sequence corresponds to a respective time series. A plurality of predictive models is generated for a first time series from the sequences of time series values. Each predictive model is to generate predicted values associated with the first time series using values of a second time series. For each of the plurality of predictive models, an error is determined between the corresponding predicted values and values associated with the first time series. A predictive model is selected for anomaly detection based on the determined error of the predictive model. Transmission is caused of an indication of an anomaly detected using the selected predictive model.

Predictive model selection for anomaly detection

Efficiently executing commands at external computing services

Graphical user interface for automated data preprocessing for machine learning

Anomaly detection based on a predicted value

A facility for defining an event subtype using examples is described. The facility displays events identified among machine-generated data. The facility receives user input selecting a first subset of the events as examples of an event subtype. In response to receiving the user input, the facility displays a second subset of the events predicted to belong to the event subtype on the basis of the examples of the event subtype.

Application of event subtypes defined by user-specified examples

An anomaly detection system includes a plurality of signals. Each of the signals is associated with an anomaly detection procedure that will be used to identify anomalies within the signal. Anomaly detection is performed by applying the anomaly detection procedure to a sequential set of data points of a signal. The signals are updated based on incoming data streams. The data streams are analyzed, and the sequential set of data points for each signal is updated based on data points extracted from the data streams.

Time series anomaly detection service

Growing community of inventors

San Francisco, CA, United States of America

Jacob Barton Leverich