公开(公告)号：US20190245950A1

公开(公告)日：2019-08-08

申请号：US16384688

申请日：2019-04-15

Applicant: Splunk Inc.

Inventor： Vladimir A. Shcherbakov ,  Michael Dickey

IPC: H04L29/06 ,  H04L29/08

Abstract: The disclosed embodiments provide a system that processes network data. During operation, the system obtains, at a remote capture agent, a first protocol classification for a first packet flow captured by the remote capture agent. Next, the system uses configuration information associated with the first protocol classification to build a first event stream from the first packet flow at the remote capture agent, wherein the first event stream comprises time-series event data generated from network packets in the first packet flow based on the first protocol classification. The system then transmits the first event stream over a network for subsequent storage and processing of the first event stream by one or more components on the network.

公开(公告)号：US20180048741A1

公开(公告)日：2018-02-15

申请号：US15799158

申请日：2017-10-31

Applicant: Splunk Inc.

Inventor： Vladimir A. Shcherbakov ,  Michael Dickey

IPC: H04L29/06 ,  H04L29/08

CPC classification number: H04L69/22 ,  H04L67/10

Abstract: The disclosed embodiments provide a system that processes network data. During operation, the system obtains, at a remote capture agent, a first protocol classification for a first packet flow captured by the remote capture agent. Next, the system uses configuration information associated with the first protocol classification to build a first event stream from the first packet flow at the remote capture agent, wherein the first event stream comprises time-series event data generated from network packets in the first packet flow based on the first protocol classification. The system then transmits the first event stream over a network for subsequent storage and processing of the first event stream by one or more components on the network.

公开(公告)号：US20170331930A1

公开(公告)日：2017-11-16

申请号：US15665268

申请日：2017-07-31

Applicant: Splunk Inc.

Inventor： Vladimir A. Shcherbakov ,  Michael Dickey

IPC: H04L29/06 ,  H04L29/08

CPC classification number: H04L69/22 ,  H04L67/10

Abstract: The disclosed embodiments provide a system that processes network data. During operation, the system obtains, at a remote capture agent, a first protocol classification for a first packet flow captured by the remote capture agent. Next, the system uses configuration information associated with the first protocol classification to build a first event stream from the first packet flow at the remote capture agent, wherein the first event stream comprises time-series event data generated from network packets in the first packet flow based on the first protocol classification. The system then transmits the first event stream over a network for subsequent storage and processing of the first event stream by one or more components on the network.

公开(公告)号：US20150295780A1

公开(公告)日：2015-10-15

申请号：US14610457

申请日：2015-01-30

Applicant: Splunk Inc.

Inventor： Fang I. Hsiao ,  Clayton S. Ching ,  Michael R. Dickey ,  Vladimir A. Shcherbakov ,  Nishant Teredesai ,  Cary Glen Noel

IPC: H04L12/24 ,  G06F3/0484

Abstract: The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system causes for display, on a computer system, a graphical user interface (GUI) for obtaining configuration information for configuring the generation of time-series event data from network packets captured by one or more remote capture agents. Next, the system causes for display, in the GUI, a first set of user-interface elements for managing one or more ephemeral event streams that contain temporarily generated time-series event data from the network packets, wherein managing the one or more ephemeral event streams comprises modifying an end time for terminating the capture of time-series event data in an ephemeral event stream. The system then updates the configuration information based on input received through the first set of user-interface elements.

Abstract translation: 所公开的实施例提供了有助于网络数据的处理的系统。 在操作期间，系统导致在计算机系统上显示用于从由一个或多个远程捕获代理捕获的网络分组生成时间序列事件数据的配置信息的图形用户界面（GUI）。 接下来，系统导致在GUI中显示第一组用户界面元素，用于管理从网络分组中包含临时生成的时间序列事件数据的一个或多个临时事件流，其中管理一个或多个短暂事件 流包括修改用于终止在短暂事件流中捕获时间序列事件数据的结束时间。 然后，系统基于通过第一组用户界面元素接收的输入来更新配置信息。