Splunk Inc.

Jiahan Wang

Adam Jamison Oliner

Erick Anthony Dean

Pradeep Baliganapalli Nagaraju

Brian Matthew Gilmore

Steve Yu Zhang

Vishal Patel

Alexandros Batsakis

Amritpal Singh Bath

Isabelle Park

Sai Krishna Sajja

Tameem Anwar

Tianyi Gou

Tingjin Xu

Samat Jain

Abhinav Prasad Nekkanti

Shanmugam Kailasam

Felix Jiang

Jibang Liu

Divya Vijayan

Multiple storage system event handling includes obtaining multiple events for storage on multiple storage systems. For each of the multiple events, field values from each event are extracted. The field values are matched to configurations of the storage systems to identify a subset of the storage system having a matching configuration. The event is transmitted to the subset. The multiple events are transmitted to heterogeneous subsets.

Multiple storage system event handling

Ingest health monitoring includes receiving an event stream of events in a data intake and query system to store on at least one storage system and obtaining an event from the event stream. Ingest health monitoring further includes transmitting the event to a selected ingest module queue for the event, updating an output rate indicator counter for the selected ingest module queue when failure to store the event in the ingest module queue occurs, obtaining the event from the selected ingest module queue, processing the event to generate a file for the event, and transmitting the file to the at least one storage system. Ingest health monitoring further includes updating the write failure indicator counter for a storage system of the at least one storage system when failure to transmit to the storage system occurs and updating the user interface based on the output rate indicator counter and the write failure indicator counter.

Ingest health monitoring

Disclosed is a technique that can be performed by a server computer system. The technique can include obtaining data from each of multiple endpoint devices to form global data. The global data can be generated by the endpoint devices in accordance with local instructions in each of the endpoint devices. The technique further includes generating global instructions based on the global data and sending the global instructions to a particular endpoint device. The global instructions configure the particular endpoint device to perform a data analytic operation that analyzes events. The events can include raw data generated by a sensor of the particular endpoint device.

Server-side operations for edge analytics

Disclosed is a technique that can be performed by an electronic device. The electronic device can generate time-stamped events, extract training data from the time-stamped events, and send the training data over a network to a remote computer. The electronic device can receive model data generated by the remote computer from the training data by use of a machine learning process, update a local model of the electronic device based on the received model data, and generate an output by processing locally sourced data of the electronic device with the updated local model.

Data analytics in edge devices

Systems and methods are disclosed for scalable bucket merging in a data intake and query system. Various components of a bucket manager can be used to monitor recently-created buckets of data in common storage that are associated with a particular tenant and a particular index, apply a comprehensive bucket merge policy to determine groups of buckets that qualify for merging, merge those group of buckets into merged buckets to be stored in the common storage, and update any information associated with the merged buckets and pre-merged buckets. These components may be shared across multiple tenants, and some of these components may be dynamically scalable based on need. This approach may also provide many additional benefits, including improved search performance from merged buckets, efficient resource utilization associated with discriminate merging, and redundancy in case of component failure.

Bucket merging for a data intake and query system using size thresholds

Disclosed is a technique that can be performed by a server computer system. The technique can include executing a machine learning process to generate a machine learning model based on global data collected from one or more electronic devices, wherein the machine learning model is described by model data. The technique can further include encapsulating the model data in a markup language document. The technique can further include sending, over a network, the markup language document to at least one electronic device of the one or more electronic devices to cause the at least one electronic device to update a local device machine learning model.

Transmitting machine learning models to edge devices for edge analytics

Scalable bucket merging for a data intake and query system

Disclosed is a technique that can be performed by an electronic device. The technique can include generating timestamped events, where the timestamped events include raw data generated by electronic device. The technique can further include obtaining results by performing a operation on the timestamped events, in accordance with instructions. The technique can further include sending the results or indicia thereof over a network to a server computer system, and receiving back new instructions generated by the server computer system based on the sent results. Lastly, the technique can include performing a new operation on timestamped events including raw data generated based by the electronic device, where the new operation can be performed in accordance with the new instructions to obtain new results.

Analytics for edge devices

Disclosed is a technique that can be performed by an electronic device. The technique can include generating raw data based on inputs to the electronic device, and sending the raw data or data items over a network to a server computer system. The sent raw data or the data items can include training data. The technique can further include receiving global model data from the server computer system over the network. The global model data may have been derived from the training data in accordance with a machine learning process. The technique can further include generating an updated local model by updating a local model associated with the electronic device based on the received global model data, and processing local data based on the updated local model to generate output data. The local data can include raw data or data items generated based on inputs to the electronic device.

Growing community of inventors

San Francisco, CA, United States of America

Jiahan Wang