Splunk Inc.

Patrick Ogdin

Glenn Block

Alexander D Munk

A data intake and query system processes and stores events, which are associated with token identifiers for tokens corresponding to data sources for the messages that the events are generated from. Thus, the data intake and query system can receive a request to provide analyses and visualizations regarding stored events associated with a particular component associated with a plurality of events, such as a data source for the messages from which the plurality of events are generated from. These requests and the resulting visualizations can be customized based on selected tokens and selected components.

Data source visualizations

A data intake and query system receives raw machine via an internet protocol (IP) such as the hypertext transfer protocol (HTTP). The system has configurable global settings for the received raw machine data that determine properties such as the metadata that is associated with raw machine data. Each event is associated with a token, which is also configurable and provides settings such as metadata settings for the raw machine data. The raw machine data is stored as events based on the metadata. Electronic devices that generate raw machine data may transmit the raw machine data to the data intake and query system within HTTP messages. The HTTP messages may also include settings such as metadata for the raw machine data. The raw machine data is stored as events based on the global metadata settings, token metadata settings, and HTTP message metadata settings.

Tokenized HTTP event collector

Data source metric visualizations

Data source tokens

Tokenized event collector

Provided are systems and methods for causing display of an index management graphical user interface (GUI). In one embodiment, a method can be provided. The method can include causing display of an index management GUI including one or more user editable fields for specifying one or more index settings; receiving, via the one or more user editable fields of the index management GUI, one or more user specified index settings; generating an index definition corresponding to the one or more user specified index settings; and distributing the index definition to one or more indexers of a data processing system. The one or more indexers are able to manage storage of data in one or more indexes based at least in part on the index definition.

Distribution of index settings in a machine data processing system

A data intake and query systems processes events received via the hypertext transfer protocol (HTTP). The HTTP events are associated with tokens. The received events are received by event collectors and distributed for storage. The data intake and query system receives requests to provide analyses and visualizations regarding the stored HTTP events. These requests can be customized based on selected tokens and selected data storage components. The visualizations are generated in response to the requests, and transmitted to the requesting device.

Growing community of inventors

Ann Arbor, MI, United States of America

Patrick Ogdin