公开(公告)号：US11194794B2

公开(公告)日：2021-12-07

申请号：US15420618

申请日：2017-01-31

Applicant: SPLUNK INC.

Inventor： Adam Jamison Oliner ,  Hongyang Zhang ,  Sergey Slepian ,  Di Lu ,  XiaoYu Jia ,  Peter Chongjin Kim ,  Manish Sainani

IPC: G06F16/242 ,  G06N5/04 ,  G06N20/00 ,  G06F16/2457 ,  G06F16/2458

Abstract: Embodiments of the present invention are directed to facilitating search input recommendations. In accordance with aspects of the present disclosure, a set of events determined from raw machine data is obtained. The events are analyzed to generate a temporal map associated with the set of events. Generally, the temporal map associates candidate terms with temporally related terms that occur within a period of time corresponding with the candidate terms. A search term input into a search field is received. Based on the input search term, the temporal map is used to identify one or more temporally related term recommendations.

公开(公告)号：US11194647B2

公开(公告)日：2021-12-07

申请号：US16526586

申请日：2019-07-30

Applicant: SPLUNK INC.

Inventor： Konstantinos Polychronis

IPC: G06F11/07 ,  G06Q20/32 ,  G06Q20/38 ,  G06Q20/40

Abstract: Various methods and systems for tracking incomplete purchases in correlation with application performance, such as application errors or crashes, are provided. In this regard, aspects of the invention facilitate monitoring transaction and application error events and analyzing data associated therewith to identify data indicating an impact of incomplete purchases in relation to an error(s) such that application performance can be improved. In various implementations, application data associated with an application installed on a mobile device is received. The application data is used to determine that an error that occurred in association with the application installed on the mobile device correlates with an incomplete monetary transaction initiated via the application. Based on the error correlating with the incomplete monetary transaction, a transaction attribute associated with the error is determined.

公开(公告)号：US11194564B1

公开(公告)日：2021-12-07

申请号：US16398128

申请日：2019-04-29

Applicant: Splunk Inc.

Inventor： Akash Dwivedi ,  Simon Foster Fishel ,  Eric Tschetter ,  Joshua Walters

IPC: G06F9/44 ,  G06F8/65 ,  G06F8/71 ,  H04L29/08 ,  G06F16/245

Abstract: Systems and methods are disclosed for providing a multi-component application, including a first and second component. Functionality of the application may be modified by modification of the first component, potentially without requiring modification of the second component. However, some functionalities added to application may require modifications to both the first and second component. To maintain compatibility between components, the first component can be configured to detect versioning information of a second component, and adjust its functionality to disable functions unavailable due to lack of compatibility with a current version of the second component. The first component can notify an end user of any such lack of compatibility, and potentially instruct the end user in updating the second component.

公开(公告)号：US11190539B2

公开(公告)日：2021-11-30

申请号：US16699299

申请日：2019-11-29

Applicant: Splunk Inc.

Inventor： Sourabh Satish ,  Oliver Friedrichs ,  Atif Mahadik ,  Govind Salinas

IPC: H04L29/06 ,  G06F21/55 ,  G06F16/28 ,  H04L12/851

Abstract: Systems, methods, and software described herein provide for managing service level agreements (SLAs) for security incidents in a computing environment. In one example, an advisement system identifies a rule set for a security incident based on enrichment information obtained for the security incident, wherein the rule set is associated with action recommendations to be taken against the incident. The advisement system further identifies a default SLA for the security incident based on the rule set, and obtains environmental characteristics related to the security incident. Based on the environmental characteristics, the advisement system determines a modified SLA for the security incident.

公开(公告)号：US20210365523A9

公开(公告)日：2021-11-25

申请号：US15799917

申请日：2017-10-31

Applicant: SPLUNK INC.

Inventor： MARC V. ROBICHAUD ,  JESSE MILLER ,  CORY BURKE ,  ALEXANDER JAMES ,  JEFFREY THOMAS LLOYD

IPC: G06F17/30

Abstract: A method includes causing display of events that correspond to search results of a search query in a table. The table includes rows representing events comprising data items of event attributes, columns forming cells with the row, the columns representing respective event attributes, and interactive regions corresponding to one or more data items of the displayed data items. The method also includes in response to the user selecting a designated interactive region, causing display of a list of options, each displayed option corresponding to an interface template for composing query commands, and based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.

公开(公告)号：US11184467B2

公开(公告)日：2021-11-23

申请号：US16668808

申请日：2019-10-30

Applicant: Splunk Inc.

Inventor： Sourav Pal ,  Christopher Madden Pride

IPC: H04L29/08

Abstract: Systems and methods for multi-thread processing of messages. An example method comprises: receiving, by a first processing thread, a plurality of network packets from a server; processing the plurality of network packets to produce a message; writing the message to a message queue; retrieving, by a second processing thread, the message from the message queue; producing a memory data structure based on the message; placing the memory data structure into a result queue; and responsive to determining that a total size of messages in the message queue exceeds a certain threshold, causing the first processing thread to suspend receiving network packets.

公开(公告)号：US20210359924A1

公开(公告)日：2021-11-18

申请号：US17443855

申请日：2021-07-28

Applicant: SPLUNK INC.

Inventor： IOANNIS VLACHOGIANNIS ,  PANAGIOTIS PAPADOMITSOS

IPC: H04L12/26 ,  H04L12/58 ,  G06Q10/06 ,  G06Q10/10 ,  G06F11/14 ,  H04L12/861

Abstract: A computer-implemented method, system, and computer-readable media are disclosed herein. In embodiments, the computer-implemented method may entail receiving, by a data service, live data associated with an entity. The entity may be, for example, a customer of the data service. The method may then route the live data to a dual-queue system of the data service. The live data may be loaded into a live data queue of the dual queue system for processing. Processing may entail generating summary statistics from the live data. An alert may then be transmitted to the customer in response to detecting the occurrence of one or more alert events. In embodiments, the alert events may include events identified in the summary statistics. Additional embodiments are described and/or claimed.

公开(公告)号：US11176146B2

公开(公告)日：2021-11-16

申请号：US16396569

申请日：2019-04-26

Applicant: SPLUNK INC.

Inventor： Steve Yu Zhang ,  Stephen Phillip Sorkin

IPC: G06F16/00 ,  G06F16/2457 ,  G06F16/22 ,  G06F16/24 ,  G06F16/182 ,  G06F16/248 ,  G06F16/33 ,  G06F16/951 ,  G06F16/23 ,  G06F16/2455 ,  G06F16/2458 ,  G06F16/9038 ,  G06F16/9535 ,  G06F16/9032 ,  H04L12/24 ,  H04L29/08

Abstract: A method, system, and processor-readable storage medium are directed towards generating a report derived from data, such as event data, stored on a plurality of distributed nodes. In one embodiment the analysis is generated using a “divide and conquer” algorithm, such that each distributed node analyzes locally stored event data while an aggregating node combines these analysis results to generate the report. In one embodiment, each distributed node also transmits a list of event data references associated with the analysis result to the aggregating node. The aggregating node may then generate a global ordered list of data references based on the list of event data references received from each distributed node. Subsequently, in response to a user selection of a range of global event data, the report may dynamically retrieve event data from one or more distributed nodes for display according to the global order.

公开(公告)号：US11163758B2

公开(公告)日：2021-11-02

申请号：US15665248

申请日：2017-07-31

Applicant: Splunk Inc.

Inventor： Alexander Douglas James ,  Sourav Pal ,  Arindam Bhattacharjee ,  Christopher Pride

IPC: G06F16/242 ,  G06F16/22

Abstract: Systems and methods are disclosed for processing queries against an external data source utilizing dynamically allocated partitions operating on one or more worker nodes. The external data source can include data that has not been processed by the system. To query the external data source, a query coordinator can generate a subquery for the external data source based on determined functionality of the data source. The subquery can identify data in the external data source for processing and a manner for processing the data. In addition, the query coordinator can dynamically allocate partitions operating on worker nodes to retrieve and intake results of the subquery. In some cases, number of partitions allocated can be based on a number of partitions supported by the external data source.

公开(公告)号：US11146574B2

公开(公告)日：2021-10-12

申请号：US16532312

申请日：2019-08-05

Applicant: SPLUNK INC.

Inventor： Sudhakar Muddu ,  Christos Tryfonas ,  Ravi Prasad Bulusu

IPC: H04L29/06 ,  G06N20/00 ,  G06F16/25 ,  G06F16/28 ,  G06F16/44 ,  G06F16/901 ,  G06F16/2457 ,  H04L12/26 ,  G06F40/134 ,  G06N20/20 ,  G06N7/00 ,  G06F3/0482 ,  G06K9/20 ,  G06F3/0484 ,  H04L12/24 ,  G06N5/04 ,  G06N5/02

Abstract: A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.