ADDRESSING MEMORY LIMITS FOR PARTITION TRACKING AMONG WORKER NODES

    公开(公告)号:US20240320231A1

    公开(公告)日:2024-09-26

    申请号:US18626007

    申请日:2024-04-03

    Applicant: Splunk Inc.

    CPC classification number: G06F16/2471 G06F16/278

    Abstract: Systems and methods are described for distributed processing a query in a first query language utilizing a query execution engine intended for single-device execution. While distributed processing provides numerous benefits over single-device processing, distributed query execution engines can be significantly more difficult to develop that single-device engines. Embodiments of this disclosure enable the use of a single-device engine to support distributed processing, by dividing a query into multiple stages, each of which can be executed by multiple, concurrent executions of a single-device engine. Between stages, data can be shuffled between executions of the engine, such that individual executions of the engine are provided with a complete set of records needed to implement an individual stage. Because single-device engines can be significantly less difficult to develop, use of the techniques described herein can enable a distributed system to rapidly support multiple query languages.

    Systems and methods for training a machine learning model to detect beaconing communications

    公开(公告)号:US12088611B1

    公开(公告)日:2024-09-10

    申请号:US17573399

    申请日:2022-01-11

    Applicant: SPLUNK Inc.

    Abstract: A computerized method is disclosed that includes operations of obtaining historical network traffic and preparing a training set of data by: applying security rules to the historical network traffic data to obtain a first filtered subset of network transmissions representing a first set of beaconing candidates that is labeled to form a first set of labeled results, applying a clustering logic to the historical network traffic data to obtain a second filtered subset of network transmissions representing a second set of beaconing candidates that is labeled to form a second set of labeled results, applying a machine learning model to the historical network traffic data to label the historical network traffic forming a third set of labeled results, wherein the first, second and third sets of labeled results are augmented to form an augmented labeled training set, and training a machine learning model using the augmented labeled training set.

    Systems and methods for machine-learning based alert grouping

    公开(公告)号:US12086045B1

    公开(公告)日:2024-09-10

    申请号:US17589833

    申请日:2022-01-31

    Applicant: Splunk, Inc.

    CPC classification number: G06F11/3075 G06F16/244 G06F16/2477 G06F18/2178

    Abstract: A computerized method is disclosed for grouping alerts through machine learning. The method including receiving an alert to be assigned to any of a plurality of existing issues or to a newly created issue, wherein an issue is a grouping of alerts, determining a temporal distance between the alert and each of the existing issues, determining either of (i) a numerical distance between the alert and each of the existing issues for a particular numerical field, or (ii) a categorical distance between the alert and each of the existing issues for a particular categorical field, determining an overall distance between the alert and each of the existing issues, and assigning the alert to either (i) an existing issue having a shortest overall distance to the alert that satisfies one or more time constraints, or (ii) the newly created issue.

    Online data forecasting
    37.
    发明授权

    公开(公告)号:US12079304B1

    公开(公告)日:2024-09-03

    申请号:US17246228

    申请日:2021-04-30

    Applicant: SPLUNK INC.

    CPC classification number: G06F18/10 G06F18/214 G06Q10/04

    Abstract: Embodiments of the present disclosure are directed to facilitating performing online data forecasting. In operation, data decomposition of an incoming data point is performed to determine a trend component associated with the incoming data point. Such a trend component, and previous trend components, can be used to determine a trend component expected for a data point subsequent to the incoming data point. A seasonality component expected for the data point subsequent to the incoming data point can be identified, for example, based on a seasonality component associated with a previous corresponding data point. Thereafter, the expected trend and seasonality components can be used to predict the data point subsequent to the incoming data point. Such a data prediction can be performed in an online processing manner such that a subsequent data point is not used to decompose the incoming data point or forecast the data point.

    Accessibility controls for manipulating data visualizations

    公开(公告)号:US12072859B1

    公开(公告)日:2024-08-27

    申请号:US18050016

    申请日:2022-10-26

    Applicant: Splunk Inc.

    Inventor: Ryan O'Connor

    CPC classification number: G06F16/22 G06F3/04847 G06F16/2474

    Abstract: A computer system displays a graphical user interface (GUI) that includes data visualizations corresponding to data having timestamps within a time interval. A first type of input signal is mapped to a second type of input signal. The first type of input signal is associated with an input device communicatively coupled to the computer system. The second type of input signal is configured to operate a graphical user control of the GUI. Before mapping, the first type of input signal is configured to perform a function that is different from operation of the graphical user control. After receiving an input signal of the first type, an input signal of the second type is applied to the graphical user control based on the mapping. The time interval is adjusted, and the data visualizations are updated automatically to correspond to updated data having timestamps within the adjusted time interval.

Patent Agency Ranking