Splunk Inc.

Splunkinc.

Jindrich Dinga

Jesse Brandau Miller

David Marquardt

Katherine Kyle Feeney

Jason Szeto

Yuan Xie

Jose Solis

Erick Anthony Dean

Jacob Sebastian Stark

Marvin Herville Green

Kieran Nicholas Cairney

Adam Jamison Oliner

Steve Yu Zhang

Cary Glen Noel

Jacob Barton Leverich

Clark Eugene Mullen

Isabelle Park

Mei Chun Yeh

Sourav Pal

Arindam Bhattacharjee

Vishal Patel

Alexandros Batsakis

Simon Foster Fishel

Thomas Allan Haggie

Finlay Cannon

Andrew Peters

Ioan Popa

Jonathan Ng

Balaji Rao

Murugan Kandaswamy

Barbara Janczer

Yiyun Zhu

Nitilaksha Halakatti

Manuel Martinez

Ningxuan He

Bardhi Shtylla

Hasti Khaki

Soomee Kang

Jeff Sredni

Chung-Han Tsai

Horst Werner

Eric Nathaniel Tschetter

Joshua Walters

Tatsuya Hama

Elizabeth Li

Chandrashekar Basavaiah

Yuchen Mou

Mudit Mittal

Kimberly Wong

Jacob Sebastion Stark

Brian Illa

Jesse Miller

Systems and methods are disclosed involving user interface (UI) search tools for locating data, including tools for summarizing indexed raw machine data that organize and present results to enable expansion and exploration of initial summarizations. The initial summarizations may be explored and refined to help users determine how to identify and best focus a search on data subsets of greater interest.

Data identification using inverted indexes

A method of monitoring hierarchical asset groups includes the operations of: receiving a plurality of asset group configuration parameters comprising one or more association specifications, each association specification defining an association between an asset and a corresponding asset group of a plurality of asset groups of an asset hierarchy; receiving definitions of one or more asset group metrics, wherein each asset group metric of the one or more asset group metrics is derived from a search of machine data associated with a corresponding asset group; associating, with each asset group of the plurality of asset groups, a corresponding asset group metric of the one or more asset group metrics; generating one or more alert definitions associated with an asset group of the plurality of asset groups; monitoring, using the one or more asset group metrics, the asset hierarchy; and generating an alert based on the one or more alert definitions.

Monitoring hierarchical asset groups

A system is described that receives a query model of a query that includes one or more query commands. The query model includes a command model that corresponds to at least query command of the one or more query commands. The system uses the command model to generate an interactive action model summary and causes a user interface to display the query and the interactive action model summary in a query actions panel. A modification to the query in the user interface causes an update to the query actions panel and a modification to the action model summary causes an update to the at least one query command of the query.

Bi-directional query updates in a user interface

Systems and methods include causing presentation of a first cluster in association with an event of the first cluster, the first cluster from a first set of clusters of events. Each event includes a time stamp and event data. Based on the presentation of the first cluster, an extraction rule corresponding to the event of the first cluster is received from a user. Similarities in the event data between the events are determined based on the received extraction rule. The events are grouped into a second set of clusters based on the determined similarities. Presentation is caused of a second cluster in association with an event of the second cluster, where the second cluster is from the second set of clusters.

Supplementing extraction rules based on event clustering

Systems, methods, and computer readable media are disclosed for generating and providing concurrent journey visualizations associated with different journey definitions. In computer-implemented embodiments, a data intake and query system, or a journey visualization computing tool, can be used to generate and provide concurrent representations corresponding with different journey definitions. In operation, a set of journey instances associated with a journey having a set of steps is obtained. Each step may be associated with at least one event that includes raw machine data produced by a component of an information technology environment. Upon obtaining different journey definitions specifying filters to apply to the set of journey instances, the data intake and query system can generate journey visualizations in accordance with the journey definitions. Thereafter, the journey visualizations corresponding with the journey definitions can be concurrently displayed by a computing device via a graphical user interface.

Generating new visualizations based on prior journey definitions

Systems and methods are described for establishing and managing components of a distributed computing framework implemented in a data intake and query system. The distributed computing framework may include a master and a plurality of worker nodes. The master may selectively operate on a search head captain that is chosen from the search heads of the data intake and query system. The search head captain may distribute configuration information for the master and the distributed computing framework to the other search heads, which in turn, may distribute that configuration information to indexers of the data intake and query system. Worker nodes may be selectively activated for operation on the indexers based on the configuration information, and the worker nodes may additionally use the configuration information to contact the master and join the distributed computing framework. This approach may provide numerous benefits, including improved security, flexibility in the selection of worker nodes, and redundancy for failures of physical components of the data intake and query system.

Management of distributed computing framework components

Data categorization using inverted indexes

A log-to-metrics transformation system includes a log-to-metrics application executing on a processor. The log-to-metrics transformation system receives a format associated with machine data, and further receives, via a first graphical control, a first set of metric identifiers corresponding to a first set of metrics associated with the machine data. The log-to-metrics transformation system generates a first set of mappings between the first set of metric identifiers and a first set of field values included in the machine data. The log-to-metrics transformation system stores the first set of mappings and an association with the format of the machine data. The log-to-metrics transformation system, based on the first set of mappings, causes the first set of field values to be extracted from the machine data. Further, a first metric included in the first set of metrics is determined based on at least a portion of the first set of field values.

Automated generation of metrics from log data

Display screen or portion thereof having a graphical user interface

An asset monitoring and reporting system (AMRS) implements an interface to establish an asset hierarchy to be monitored and reported against. The interface employs a search query of extant asset data from which definitional aspects of the asset hierarchy can be identified, and therefrom the interface automatically determines control information reflective of the asset hierarchy to direct the ongoing operation of the AMRS. The interface further allows for configuration of a metric definition for a metric of an asset node of the asset hierarchy, the metric representing a point in time or a period of time and derived from a metric-time search of machine data produced by or about the asset node and receives an identification of a metric determination specification for the metric definition, the metric determination specification comprising at least identification of a metric component and identification of a calculation operation to apply to the metric component.

Monitoring asset hierarchies based on asset group metrics

Clustering events while excluding extracted values

A method includes in response to a user selection of a command of a coding language, causing display of a set of argument blocks in a text input region based on syntax of the command Each argument block allows the user to input a value of an argument of the command to the argument block. In response to a user selection to modify the set of argument blocks, an argument block is added to the set of argument blocks displayed in the text input region based on the syntax of the command. In response to receiving from the user the input of the value of the argument to the added argument block, the command is caused to be coded in the text input region with at least the argument having the value from the input to the added argument block.

Coding commands using syntax templates

Growing community of inventors

Los Altos, CA, United States of America

Jindrich Dinga