Column-based table manipulation of event data

    公开(公告)号:US09977803B2

    公开(公告)日:2018-05-22

    申请号:US14611018

    申请日:2015-01-30

    Applicant: SPLUNK, INC.

    CPC classification number: G06F17/30315 G06F17/30386 G06F17/30477

    Abstract: A search interface is displayed in a table format that includes a plurality of columns, each column including data items of an event attribute, the data items being of a set of events, each column being selectable by a user, and a plurality of rows forming cells with the one or more columns, each cell comprising one or more of the data items of the event attribute of a corresponding column. Based on the user selecting one or more of the columns, a list of options is displayed corresponding to the selected one or more columns, and one or more commands are added to a search query that corresponds to the set of events. The one or more commands are based on at least an option that is selected from the list of options and the event attribute of each of the selected one or more columns.

    Producing search results by aggregating messages from multiple search peers

    公开(公告)号:US09942318B2

    公开(公告)日:2018-04-10

    申请号:US15334690

    申请日:2016-10-26

    Applicant: Splunk Inc.

    Abstract: Asynchronous processing of messages that are received from multiple servers is disclosed. An example method may include transmitting, by a computer system, a search request to a plurality of search peers of a data aggregation and analysis system. The method may further include receiving a plurality of sub-application layer protocol packets from the plurality of search peers. The method may further include parsing, by a first processing thread of the computer system, one or more sub-application layer protocol packets of the plurality of sub-application layer protocol packets, to produce an application layer message representing a partial response to the search request. The method may further include processing, by a second processing thread of the computer system, the application layer message to produce a memory data structure representing an aggregated response to the search request.

    MANAGING THE COLLECTION OF FORENSIC DATA FROM ENDPOINT DEVICES

    公开(公告)号:US20180091559A1

    公开(公告)日:2018-03-29

    申请号:US15276761

    申请日:2016-09-26

    Applicant: Splunk Inc.

    Inventor: Brian Luger

    Abstract: Techniques and mechanisms are disclosed enabling efficient collection of forensic data from client devices, also referred to herein as endpoint devices, of a networked computer system. Embodiments described herein further enable correlating forensic data with other types of non-forensic data from other data sources. A network security application described herein further enables generating various dashboards, visualizations, and other interfaces for managing forensic data collection, and displaying information related to collected forensic data and information related to identified correlations between items of forensic data and other items of non-forensic data.

    CORRELATING FORENSIC DATA COLLECTED FROM ENDPOINT DEVICES WITH OTHER NON-FORENSIC DATA

    公开(公告)号:US20180091529A1

    公开(公告)日:2018-03-29

    申请号:US15276763

    申请日:2016-09-26

    Applicant: Splunk Inc.

    Inventor: Brian Luger

    Abstract: Techniques and mechanisms are disclosed enabling efficient collection of forensic data from client devices, also referred to herein as endpoint devices, of a networked computer system. Embodiments described herein further enable correlating forensic data with other types of non-forensic data from other data sources. A network security application described herein further enables generating various dashboards, visualizations, and other interfaces for managing forensic data collection, and displaying information related to collected forensic data and information related to identified correlations between items of forensic data and other items of non-forensic data.

    AUTOMATICALLY GENERATING FIELD EXTRACTION RECOMMENDATIONS

    公开(公告)号:US20180089561A1

    公开(公告)日:2018-03-29

    申请号:US15420754

    申请日:2017-01-31

    Applicant: SPLUNK INC.

    Abstract: Systems and methods include obtaining a set of events, each event in the set of events comprising a time-stamped portion of raw machine data, the raw machine data produced by one or more components within an information technology or security environment and reflects activity within the information technology or security environment. Thereafter, a first neural network is used to automatically identify variable text to extract as a field from the set of events. An indication of the variable text is provided as a field extraction recommendation, for example, to a user device for presentation to a user.

Patent Agency Ranking