Field Extraction Rules from Clustered Data Samples

    公开(公告)号:US20170286525A1

    公开(公告)日:2017-10-05

    申请号:US15143563

    申请日:2016-04-30

    Applicant: Splunk Inc.

    CPC classification number: G06F16/287 G06F16/2477

    Abstract: The operation of an automatic data input and query system is controlled by well-defined control data. Certain control data may relate to data schemas and direct operations performed by the system to extract fields from machine data. Automatic methods may determine proper field extraction control information by analyzing a sample of data from a source, breaking the sample data into event segments, classifying the segments into groups based on a measure of similarity, determining an operable extraction rule for each group, and storing the resulting extraction model. Data patterns known by the system can be leveraged to perform the event breaking and field identification for the classifying. Embodiments may provide a user interface to view, interact with, and approve the computer-generated extraction model.

    Transformation of network data at remote capture agents

    公开(公告)号:US09762443B2

    公开(公告)日:2017-09-12

    申请号:US14253753

    申请日:2014-04-15

    Applicant: Splunk Inc.

    Inventor: Michael Dickey

    Abstract: The disclosed embodiments provide a method and system for processing network data. During operation, the system obtains, at a remote capture agent, configuration information for the remote capture agent from a configuration server over a network. Next, the system uses the configuration information to configure the generation of event data from network data obtained from network packets at the remote capture agent. The system then uses the configuration information to configure transformation of the event data or the network data into transformed event data at the remote capture agent.

    Proactive monitoring tree providing distribution stream chart with branch overlay

    公开(公告)号:US09754395B2

    公开(公告)日:2017-09-05

    申请号:US14801721

    申请日:2015-07-16

    Applicant: Splunk Inc.

    CPC classification number: G06T11/206

    Abstract: The disclosed embodiments relate to a system that displays performance data for a computing environment. During operation, the system first determines values for a performance metric for a plurality of entities that comprise the computing environment. Next, the system displays the computing environment as a set of nodes representing the plurality of entities. While displaying the nodes, the system displays a chart with a line illustrating how a value of the performance metric for the selected node varies over time, wherein the line is displayed against a background illustrating how a distribution of the performance metric for a reference subset of the set of nodes varies over time.

    Tracking incomplete transactions in correlation with application errors

    公开(公告)号:US09747152B2

    公开(公告)日:2017-08-29

    申请号:US14697427

    申请日:2015-04-27

    Applicant: SPLUNK INC.

    Abstract: Various methods and systems for tracking incomplete purchases in correlation with application performance, such as application errors or crashes, are provided. In this regard, aspects of the invention facilitate monitoring transaction and application error events and analyzing data associated therewith to identify data indicating an impact of incomplete purchases in relation to an error(s) such that application performance can be improved. In various implementations, application data associated with an application installed on a mobile device is received. The application data is used to determine that an error that occurred in association with the application installed on the mobile device correlates with an incomplete monetary transaction initiated via the application. Based on the error correlating with the incomplete monetary transaction, a transaction attribute associated with the error is determined.

    DETECTION OF SECURITY TRANSACTIONS
    460.
    发明申请

    公开(公告)号:US20170223030A1

    公开(公告)日:2017-08-03

    申请号:US15011414

    申请日:2016-01-29

    Applicant: Splunk Inc.

    CPC classification number: H04L63/1416 H04L63/02

    Abstract: In a method, a plurality of events is accessed, wherein an event of the plurality of events includes a portion of raw-machine data from a data source of a plurality of data sources. For at least one event of the plurality of events, a transaction phase of a computer security transaction is correlated with the at least one event based at least in part on a data source associated with the at least one event. The transaction phase of the at least one event is correlated with a particular asset of a plurality of assets.

Patent Agency Ranking