Interval-based generation of event streams by remote capture agents

    公开(公告)号:US11296951B2

    公开(公告)日:2022-04-05

    申请号:US16908564

    申请日:2020-06-22

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system obtains a set of event streams from one or more remote capture agents over one or more networks, wherein the set of event streams comprises time-series event data generated from network packets captured by the one or more remote capture agents. Next, the system causes for display, within a graphical user interface (GUI), a first set of user interface elements, wherein the first set of user interface elements includes event stream information for an event stream in the set of event streams and a first graph of a metric associated with the time-series event data in the event stream. The system then updates the first graph in real-time with the time-series event data from the one or more remote capture agents.

    Generating event streams including aggregated values from monitored network data

    公开(公告)号:US11281643B2

    公开(公告)日:2022-03-22

    申请号:US16436818

    申请日:2019-06-10

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for specifying a grouping of a set of event streams containing the time-series event data by an event stream attribute associated with the event streams. The system then causes for display, in the GUI, a second set of user-interface elements containing event stream information for one or more subsets of the event streams represented by the grouping of the event streams by the event stream attribute.

    GENERATING EVENT STREAMS INCLUDING AGGREGATED VALUES FROM MONITORED NETWROK DATA

    公开(公告)号:US20190294598A1

    公开(公告)日:2019-09-26

    申请号:US16436818

    申请日:2019-06-10

    Applicant: Splunk Inc.

    Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for specifying a grouping of a set of event streams containing the time-series event data by an event stream attribute associated with the event streams. The system then causes for display, in the GUI, a second set of user-interface elements containing event stream information for one or more subsets of the event streams represented by the grouping of the event streams by the event stream attribute.

    FACILITATING CUSTOM CONTENT EXTRACTION FROM NETWORK PACKETS
    15.
    发明申请
    FACILITATING CUSTOM CONTENT EXTRACTION FROM NETWORK PACKETS 审中-公开
    促进网络包的自定义内容提取

    公开(公告)号:US20160226944A1

    公开(公告)日:2016-08-04

    申请号:US14609292

    申请日:2015-01-29

    Applicant: SPLUNK INC.

    CPC classification number: H04L69/22 H04L43/028 H04L43/0876

    Abstract: The disclosed embodiments provide a system for extracting custom content from network packets. During operation, the system receives a stream of packets. The system then parses packets in the stream to determine a protocol for each packet. Next, the system applies a custom-content-extraction rule to each packet associated with a target protocol to obtain the extracted content. Then, the system stores the extracted content in events in a data store to facilitate subsequent queries involving the extracted content.

    Abstract translation: 所公开的实施例提供了一种用于从网络分组中提取定制内容的系统。 在操作过程中,系统接收到一个数据包流。 然后系统解析流中的数据包,以确定每个数据包的协议。 接下来,系统对与目标协议相关联的每个分组应用自定义内容提取规则以获得提取的内容。 然后,系统将所提取的内容存储在数据存储器中的事件中,以便于涉及提取的内容的后续查询。

    GROUPING AND MANAGING EVENT STREAMS GENERATED FROM CAPTURED NETWORK DATA
    16.
    发明申请
    GROUPING AND MANAGING EVENT STREAMS GENERATED FROM CAPTURED NETWORK DATA 审中-公开
    从捕获的网络数据生成的事件流的分组和管理

    公开(公告)号:US20150293954A1

    公开(公告)日:2015-10-15

    申请号:US14610408

    申请日:2015-01-30

    Applicant: Splunk Inc.

    CPC classification number: G06F16/22 G06F16/24568 H04L65/60

    Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display a graphical user interface (GUI) for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for specifying a grouping of a set of event streams containing the time-series event data by an event stream attribute associated with the event streams. The system then causes for display, in the GUI, a second set of user-interface elements containing event stream information for one or more subsets of the event streams represented by the grouping of the event streams by the event stream attribute.

    Abstract translation: 所公开的实施例提供了有助于网络数据的处理的系统。 在操作期间,该系统导致显示用于从由一个或多个远程捕获代理捕获的网络分组生成时间序列事件数据的图形用户界面(GUI)。 接下来,系统导致在GUI中显示第一组用户界面元素,用于通过与事件流相关联的事件流属性来指定包含时间序列事件数据的一组事件流的分组。 然后,系统在GUI中显示第二组用户界面元素,其包含由事件流属性对事件流的分组表示的事件流的一个或多个子集的事件流信息。

    Configuring event streams based on identified security risks

    公开(公告)号:US11818018B1

    公开(公告)日:2023-11-14

    申请号:US17875170

    申请日:2022-07-27

    Applicant: Splunk Inc.

    CPC classification number: H04L41/22 H04L43/022 H04L43/045

    Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for managing one or more ephemeral event streams that contain temporarily generated time-series event data from the network packets, wherein managing the one or more ephemeral event streams comprises modifying an end time for terminating the capture of time-series event data in an ephemeral event stream. The system then updates the configuration information based on input received through the first set of user-interface elements.

Patent Agency Ranking