-
公开(公告)号:US20220036002A1
公开(公告)日:2022-02-03
申请号:US16945448
申请日:2020-07-31
Applicant: Splunk Inc.
Inventor: Ram Sriharsha , Zhaohui Wang
IPC: G06F40/284 , G06N20/00 , G06N5/04 , G06F16/33 , G06F40/242
Abstract: Systems and methods are described for training an artificial intelligence model to infer a log sourcetype of a log. For example, logs may have different log sourcetypes, and logs having the same log sourcetypes may have different messagetypes. The artificial intelligence model may be a machine learning model, and can be trained using training data that includes logs with known log sourcetypes. Each log can be tokenized, filtered, converted into a vector, and applied to a machine learning model as an input to perform the training. The machine learning model may output an inferred log sourcetype, which can be compared with the known log sourcetype to update model parameters to improve the machine learning model accuracy. The trained machine learning model may be trained to infer a log sourcetype of a log regardless of the messagetype of the log.
-
公开(公告)号:US20220035775A1
公开(公告)日:2022-02-03
申请号:US16945229
申请日:2020-07-31
Applicant: Splunk Inc.
Inventor: Ram Sriharsha , Zhaohui Wang
Abstract: Systems and methods are described for training an artificial intelligence model to extract one or more data fields from a log. For example, the artificial intelligence model may be a neural network. The neural network may be trained using training data obtained by iterating through a plurality of logs using active learning, and selecting a subset of the logs in the plurality to be labeled by a user. For example, the selected subset of logs may be logs that are not similar to other logs already labeled by a user. The user may be prompted to label the selected subset of logs to identify one or more data fields to extract. Once the selected subset of logs are labeled, these labeled logs can be used as the training data to train the neural network.
-
公开(公告)号:US11238112B2
公开(公告)日:2022-02-01
申请号:US16675026
申请日:2019-11-05
Applicant: Splunk Inc.
Inventor: James Alasdair Robert Hodge , Sourav Pal , Arindam Bhattacharjee , Mustafa Ahamed
IPC: G06F16/00 , G06F16/951 , G06F16/21 , G06F16/25 , G06F16/904 , G06F16/901 , G06F16/9038 , G06F16/903 , G06F16/248 , G06F16/2458 , G06F16/27 , G06F16/2455
Abstract: The disclosed embodiments also include monitoring and metering services of the data fabric service (DFS) system. Specifically, these services can include techniques for monitoring and metering metrics of the DFS system. The metrics are standards for measuring use or misuse of the DFS system. Examples of the metrics include data or components of the DFS system. For example, a metric can include data stored or communicated by the DFS system or components of the DFS system that are used or reserved for exclusive use by customers. The metrics can be measured with respect to time or computing resources (e.g., CPU utilization, memory usage) of the DFS system. For example, a DFS service can include metering the usage of particular worker nodes by a customer over a threshold period of time.
-
公开(公告)号:US11232124B2
公开(公告)日:2022-01-25
申请号:US16751063
申请日:2020-01-23
Applicant: SPLUNK INC.
Inventor: R. David Carasso , Micah James Delfino
IPC: G06F16/25 , G06F16/35 , G06F16/28 , G06F16/904 , G06F7/24 , G06F3/0482 , G06F3/0484 , G06F3/0488
Abstract: Embodiments are directed towards generating a representative sampling as a subset from a larger dataset that includes unstructured data. A graphical user interface enables a user to provide various data selection parameters, including specifying a data source and one or more subset types desired, including one or more of latest records, earliest records, diverse records, outlier records, and/or random records. Diverse and/or outlier subset types may be obtained by generating clusters from an initial selection of records obtained from the larger dataset. An iteration analysis is performed to determine whether a sufficient number of clusters and/or cluster types have been generated that exceed at least one threshold and when not exceeded, additional clustering is performed on additional records. From the resultant clusters, and/or other subtype results, a subset of records is obtained as the representative sampling subset.
-
公开(公告)号:US11227208B2
公开(公告)日:2022-01-18
申请号:US15224489
申请日:2016-07-29
Applicant: Splunk, Inc.
Inventor: Adam Oliner , Zidong Yang , Sinduja Sreshta
IPC: G06N3/04 , G06N20/00 , G06Q10/06 , G06F40/274
Abstract: Described herein is a technology that facilitates the production of and the use of automated datagens for event-based. A datagen (i.e., data-generator or data generation system) is a component, module, or subsystem of computer systems that searches, monitors, and analyzes machine data. A datagen produces events that are further processed in various ways for subsequent use (such as searching, monitoring, and analysis).
-
公开(公告)号:US11222014B2
公开(公告)日:2022-01-11
申请号:US15799917
申请日:2017-10-31
Applicant: SPLUNK INC.
Inventor: Marc V. Robichaud , Jesse Miller , Cory Burke , Alexander James , Jeffrey Thomas Lloyd
IPC: G06F16/2452 , G06F16/26 , G06F16/33 , G06F16/23 , G06F16/242 , G06F16/2458 , G06F16/2453 , G06F16/2455 , G06F16/22 , G06F3/0484 , G06F16/00 , G06F21/62 , G06F40/177 , G06Q10/00 , G06T11/20 , G06F3/0482 , G06Q10/10
Abstract: A method includes causing display of events that correspond to search results of a search query in a table. The table includes rows representing events comprising data items of event attributes, columns forming cells with the row, the columns representing respective event attributes, and interactive regions corresponding to one or more data items of the displayed data items. The method also includes in response to the user selecting a designated interactive region, causing display of a list of options, each displayed option corresponding to an interface template for composing query commands, and based on the user selecting an option in the displayed list of options, causing one or more commands to be added to the search query, the one or more commands composed based on the one or more data items that corresponds to the designated interactive region according to instructions of the interface template of the selected option.
-
公开(公告)号:US20220004444A1
公开(公告)日:2022-01-06
申请号:US17448196
申请日:2021-09-20
Applicant: Splunk Inc.
Inventor: Michael Joseph Baum , R. David Carasso , Robin Kumar Das , Bradley Hall , Brian Philip Murphy , Stephen Phillip Sorkin , Andre David Stechert , Erik M. Swan , Rory Greene , Nicholas Christian Mealy , Christina Frances Regina Noren
IPC: G06F9/54
Abstract: Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.
-
公开(公告)号:US11216491B2
公开(公告)日:2022-01-04
申请号:US15143563
申请日:2016-04-30
Applicant: Splunk Inc.
Inventor: Li Li , Gang Tao , Yongxin Su , Junqing Hao , Ting Wang , John Robert Coates , Elias Haddad , Guodong Wang
IPC: G06N20/00 , G06F16/28 , G06F16/2458
Abstract: The operation of an automatic data input and query system is controlled by well-defined control data. Certain control data may relate to data schemas and direct operations performed by the system to extract fields from machine data. Automatic methods may determine proper field extraction control information by analyzing a sample of data from a source, breaking the sample data into event segments, classifying the segments into groups based on a measure of similarity, determining an operable extraction rule for each group, and storing the resulting extraction model. Data patterns known by the system can be leveraged to perform the event breaking and field identification for the classifying. Embodiments may provide a user interface to view, interact with, and approve the computer-generated extraction model.
-
公开(公告)号:US20210406100A1
公开(公告)日:2021-12-30
申请号:US17447408
申请日:2021-09-10
Applicant: Splunk Inc.
Inventor: Michael Joseph Baum , R. David Carasso , Robin Kumar Das , Bradley Hall , Brian Philip Murphy , Stephen Phillip Sorkin , Andre David Stechert , Erik M. Swan , Rory Greene , Nicholas Christian Mealy , Christina Frances Regina Noren
IPC: G06F9/54
Abstract: Methods and apparatus consistent with the invention provide the ability to organize and build understandings of machine data generated by a variety of information-processing environments. Machine data is a product of information-processing systems (e.g., activity logs, configuration files, messages, database records) and represents the evidence of particular events that have taken place and been recorded in raw data format. In one embodiment, machine data is turned into a machine data web by organizing machine data into events and then linking events together.
-
公开(公告)号:US11210622B2
公开(公告)日:2021-12-28
申请号:US15339787
申请日:2016-10-31
Applicant: Splunk Inc.
Inventor: Ian Matthew Link , Alexander Lynn Raitz , Melanie Ann Garcia Alrajhi , Shruti Shrivastava , Fang I. Hsiao
IPC: G06Q10/06 , G06F40/205 , G06F16/903 , G06Q10/08
Abstract: Embodiments of the present invention are directed to generating augmented process models for use in process analytics. In one embodiment, a process model, search indicators, composite attributes, and relationship indicators are received. The process model defines a process and includes a plurality of components of the process. Search indicators indicate a search that, when executed, provides data related to the corresponding component. Composite attributes indicate data to be captured by machine data searches associated with the corresponding component. Relationship indicators indicate relationships between components of the process. An augmented process model is generated based on the process model, the search indicators, the composite attributes, and the relationship indicators, wherein the augmented process model is used to manage process instances associated with the process.
-
-
-
-
-
-
-
-
-