Splunk Inc.

Oath Inc.

Excalibur Ip, LLC

Verizon Media Inc.

Joshua Walters

Eric Nathaniel Tschetter

Simon Foster Fishel

Isabelle Park

Joerg Beringer

Akash Dwivedi

Vivian Shen

Elizabeth Li

Chandrashekar Basavaiah

Mayank Agarwal

Michael Natkovich

Rahul Gidwani

Cary Glen Noel

Horst Werner

Jindrich Dinga

Mei Chun Yeh

Miao Chen

Jonathan Dillman

John Bennett Wundes

Niru Appikatala

Akshai Sarma

Systems and methods are disclosed for providing a multi-component application, including a first and second component, and a first and second server. The first component may be implemented at the first server, while a second component may be implemented at a client device. An end user of a client device may request access to metadata stored on the second server that is utilized by the second component to implement the multi-component application. The end user may authenticate with the first component. The first component may then communicate with the second server to authenticate the end user to the second server, thereby granting the end user access to the second server without having to reauthenticate to the second server.

Enabling pass-through authentication in a multi-component application

A method of persisting and querying Real User Monitoring (RUM) data comprises grouping together spans associated with a user-interaction with a webpage or application that are ingested during a given time duration. The method also comprises generating one or more data sets each associated with an analysis modality using the grouped spans, wherein each analysis modality extracts a different level of detail from the spans. Further, the method comprises selecting, based on a first user query, a first analysis modality for generating a response to the first user query and accessing a data set that is associated with the first analysis modality. The method also comprises generating the response to the first user query using the data set associated with the first analysis modality, wherein the first user query requests information pertaining to a performance of the application in response to the user-interaction.

Multiple modalities of data collection and analysis for real-time monitoring (RUM) in a microservices-based architecture

Systems and methods are disclosed for supporting transformations of a graph generated from a query to event data. The event data may be unstructured event data, from which instances of a journey can be identified that represent sequences of related events describing actions performed in a computing environment. When evaluating journey instances, it can be helpful to visualize the instances as a graph. Depending on the instances viewed, a user may desire different modifications to the graph. While such modifications can be made when initially building instances from the unstructured event data, this can limit reuse of the resulting instances (since the modification would also be present when evaluating other subsets). To address this, embodiments of the present disclosure enable graph modifications to be applied to subsets of journey instances after building those instances from unstructured event data, increasing reuse of instances built from a query against the unstructured data.

Supporting graph data structure transformations in graphs generated from a query to event data

Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be easily and rapidly modified by modification to the first component, without requiring modification to the second component. The first component may be implemented locally at a client device, while the second component is implemented remotely. While modification of the second component may require privileges of a remote location, a user of a client device may modify the first component while maintaining interoperability and compatibility with the second component, thereby enabling the end user to modify functionality of the multi-component application. In some instances, different versions of a first component are provided, and an end user of a client device is enabled to specify which version of the first component should be used.

Enabling agile functionality updates using multi-component application

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events, the system can build a journey instance.

Relating events and matching events to steps of a process using field values from different fields

A method of identifying exemplary spans associated with a real user session comprises aggregating ingested spans associated with user interaction with an application during the user session. The method also comprises segmenting the user session into chunks and storing each chunk with an identifier indicating a location of a respective chunk. Further, responsive to user-specified parameters included in a query, the method comprises accessing a chunk using a respective identifier and applying the user-specified parameters to spans in the chunk. Additionally, the method comprises rendering a waterfall visualization comprising exemplary spans associated with the user session, wherein the exemplary spans surface in response to the applying the user-specified parameters to the plurality of spans in the chunk.

Surfacing and displaying exemplary spans from a real user session in response to a query

Journey instance generation based on one or more pivot identifiers and one or more step identifiers

Systems and methods are disclosed for efficiently detecting alert states within unstructured event data. Alert states are illustratively defined as occurring when a threshold number of journey instances are present within the unstructured event data, each journey instance representing a series of events within the event data representing steps within a pre-defined journey. Detecting journey instances within unstructured event data can require significant computational resources, and thus attempting to detect alert states directly from unstructured event data can lead to inefficiencies. Embodiments of this disclosure enable a structured data set of journey instances to be generated from unstructured event data, and for the structured data set to be evaluated based on criteria of multiple alert states. By utilizing a single structured data set to support evaluation based on multiple alert states, detecting alert states from unstructured event data is rendered more efficient.

Efficient detection of alert states within unstructured event data based on evaluation of structured data set

The present teaching generally relates to detecting data bucket discrepancies associated with online experiments. In a non-limiting embodiment, a monitoring layer may be generated within an online experimentation platform that includes at least a first layer, and where a first online experiment is associated with the first layer, the monitoring layer includes a monitoring layer data bucket, and the first layer includes at least a first data bucket. First data representing user activity associated with a first plurality of identifiers may be obtained, the user activity being associated with the first layer. Second data representing at least one user engagement parameter may be generated, and a first discrepancy between the first and second data may be determined. The first discrepancy indicating a first amount of identifiers that include a first metadata tag associated with the first layer and lack a second metadata tag associated with the monitoring layer.

Method and system for detecting gaps in data buckets for A/B experimentation

Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be modified by modification of the first component, potentially without requiring modification of the second component. However, some functionalities added to application may require modifications to both the first and second component. To maintain compatibility between components, the first component can be configured to detect versioning information of a second component, and adjust its functionality to disable functions unavailable due to lack of compatibility with a current version of the second component. The first component can notify an end user of any such lack of compatibility, and potentially instruct the end user in updating the second component.

Maintaining compatibility in a multi-component application

Systems and methods are disclosed for processing events having raw machine data associated with a timestamp using one or more pivot identifiers and one or more step identifiers to generate one or more journey instances. Based on the one or more pivot identifier field, the system can relate events that have a common field value for the pivot identifier field. Based on the one or more step identifiers, the system can group the related events into a subset of events. Using the subset of events the system can build a journey instance.

Growing community of inventors

Santa Clara, CA, United States of America

Joshua Walters