Splunk Inc.

Ramkumar Chandrasekharan

Fang I Hsiao

Vladimir A Shcherbakov

Clayton S Ching

Wei Jiang

Ramprasad Siva Golla

Shailendra Suryawanshi

Tristan Antonio Fletcher

Sourav Pal

Arindam Bhattacharjee

William Deaderick

Xiang Zhou

Lila Fridley

Alpesh Sheth

Disclosed embodiments receive an event stream from a remote capture agent. The event stream includes timestamped event data generated by the remote capture agent based on network traffic monitored by the remote capture agent. A graphical user interface (GUI) is caused to be displayed for obtaining configuration information for configuring the generation of time-series event data from network packets captured by the remote capture agent. A set of statistics is generated from the time-series event data, and the configuration information is updated to trigger subsequent storage and processing of at least a portion of the event stream by one or more components on a network based on one or more of the statistics, a storage limit associated with the time-series event data, an index volume of the event stream, a historical trend associated with the statistics, or input through the GUI.

Configuring generation of time-series event data from network packets captured by remote capture agent

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements containing a set of statistics associated with one or more event streams that comprise the time-series event data. The system then causes for display, in the GUI, one or more graphs comprising one or more values from the set of statistics. Finally, the system causes for display, in the GUI, a value of a statistic from the set of statistics based on a position of a cursor over the one or more graphs.

Selective event stream data storage based on network traffic volume

Systems and methods are described for using a streaming data processor to group notable events reflecting operation of a computing system into episodes of related events reflecting an incident on the computing system, such as to enable root cause analysis of the incident. Each notable event can be generated based on one or more events detected within raw machine data. The streaming data processor can ingest a data stream of notable events, and apply a clustering algorithm to the events to cluster those events into episodes. When the episodes satisfy an action rule, the streaming data processor can take an action appropriate to that rule, such as transmitting an alert or programmatically altering operation of the computing system. The streaming data processor can utilize feedback as to the grouping of events into episodes to modify the clustering algorithm and improve accuracy of clustering.

Grouping evens into episodes using a streaming data processor

Systems and methods are described for training a machine learning (ML) model to group notable events reflecting operation of a computing system into episodes of related events reflecting an incident on the computing system, such as to enable root cause analysis of the incident. The ML model is trained using pairwise binary similarity labels (PBSLs) indicating that two events must or must not be grouped together. An interface is provided that facilitates rapid generating of PBSLs by relocating one or more events from a first episode to a second episode. The relocation input is translated into PBSLs that are then used to train the ML model.

Interface for incorporating user feedback into training of clustering model

Selective event stream data storage based on historical stream data

Systems and methods are disclosed for processing queries against a common storage utilizing dynamically allocated partitions operating on one or more worker nodes. The common storage can include one or more data stores, which collectively contain a data set divided across multiple buckets of data. To query the common storage, a query coordinator can retrieve metadata regarding the multiple buckets, in order to determine a subset of buckets that are potentially relevant to a query. The query coordinator can then dynamically allocate partitions operating on worker nodes to retrieve and intake individual buckets of the subset into a phased search process. The dynamic allocation can be selected to maximize parallelization of the buckets across partitions, thus increasing a speed at which the common storage can be searched.

Dynamic resource allocation for common storage query

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for managing one or more event streams containing the time-series event data, wherein managing the one or more event streams includes enabling the generation of a set of statistics from an event stream without subsequently storing and processing at least a first portion of the event stream by one or more components on a network. The GUI then updates the configuration information based on input received through the first set of user-interface elements.

Growing community of inventors

San Jose, CA, United States of America

Ramkumar Chandrasekharan