Microsoft Technology Licensing, LLC

Russell Biles

Gueorgui Chkodrov

Jose Wilson Morris

Vidhi Agarwal

Dawn Antonette Burns

Lucius B Fleuchaus

Jonathan Peary Morris

Jeffrey Scott Shaw

Marek Jedrzejewicz

Andre Oneal Alfred

William Kendall Hollis

David Lloyd Fosth

Georgi Chkodrov

Justin Minaker

Anjani Kumar Lavania

The automated creation of a dataflow graph of a standing query. Once the standing query dataflow graph is created, events may be flowed into the dataflow graph to execute the standing query. In execution, a store query is accessed. The store query is structured in accordance with a store query language. A syntax graph (such as an abstract syntax tree) of the store query may then be generated. Then, using the syntax graph and a set of rules of the store query language, the dataflow graph is automatically generated. This significant speeds up and makes more easy and efficient the conversion of a store query into a standing query.

Standing query creation using store query

According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to receive a query, in which the query may define an event pertaining to the apparatus to be identified and summarization instructions. The processor may also implement the query on tracked events pertaining to the apparatus to identify event data pertaining to the apparatus that matches the event defined in the query and summarize the identified event data according to the summarization instructions to generate summarized event data responsive to the query. The processor may further output the summarized event data.

Summarized event data responsive to a query

The storage of events of multiple types in a queriable table. The queriable table has at least one common column that corresponds to a field that is common across events regardless of event type. The queriable table also has at least one field-varying column that corresponds to a type-dependent field that depends on event type. The queriable table is populated using multiple events. For instance, the event could be at least some log events that are received from multiple computing systems. The population occurs by assigning each event to a row of the queriable table. The common column is populated with values taken the same common field across event types. On the other hand, the field-varying column is populated with values of different fields from those events depending on the event type.

Event table management using type-dependent portions

Growing community of inventors

Bellevue, WA, United States of America

Russell Biles