Executing data searches using generation identifiers

    公开(公告)号:US11003687B2

    公开(公告)日:2021-05-11

    申请号:US16451582

    申请日:2019-06-25

    Applicant: SPLUNK, INC.

    Abstract: Techniques and mechanisms are disclosed to execute data searches using generation identifiers. In general, a method of executing the searches comprises broadcasting, from a search head, a first query to a plurality of indexers in a cluster, wherein a portion of the first query is directed to a set of data, and wherein the set of data comprises time-stamps within a particular time frame. The method further comprises providing, with the first query, a first generation identifier for the set of data, wherein the first generation identifier identifies a first indexer from the plurality of indexers to serve as a primary indexer for responding to queries that comprise the first generation identifier and that pertain to the set of data, wherein one or more indexers in the cluster other than the first indexer are designated as secondary indexers, wherein the secondary indexers are configured to ignore queries that pertain to the set of data and that comprise the first generation identifier. Subsequently, the method comprises receiving a response to the first query from the plurality of indexers.

    Securely executing custom playbook code in a hybrid execution environment

    公开(公告)号:US10999164B1

    公开(公告)日:2021-05-04

    申请号:US16863896

    申请日:2020-04-30

    Applicant: Splunk Inc.

    Abstract: Techniques are described for enabling a cloud-based IT and security operations application to execute playbooks containing custom code in a manner that mitigates types of risk related to the misuse of cloud-based resources and security of user data. Users use a client application to create and modify playbooks and, upon receiving input to save a playbook, the client application determines whether the playbook includes custom code. If the client application determines that the playbook includes custom code, the client application establishes a connection with a proxy application (also referred to as an “automation broker”) running in the user's own on-premises network and sends a representation of the playbook to the proxy application. The client application further sends to the IT and security operations application an identifier of the playbook and an indication that the playbook (or the custom code portions of the playbook) is stored within the user's on-premises network.

    ONLINE MACHINE LEARNING ALGORITHM FOR A DATA INTAKE AND QUERY SYSTEM

    公开(公告)号:US20210117857A1

    公开(公告)日:2021-04-22

    申请号:US16779456

    申请日:2020-01-31

    Applicant: Splunk Inc.

    Inventor: Ram Sriharsha

    Abstract: Systems and methods are described for processing ingested data using an online machine learning algorithm as the data is being ingested. For example, the online machine learning algorithm can be an adaptive thresholding algorithm used to identify outliers in a moving window of data. As another example, the online machine learning algorithm can be a sequential outlier detector that detects anomalous sequences of logs or events. As another example, the online machine learning algorithm can be a sentiment analyzer that determines whether text has a positive, negative, or neutral sentiment. As another example, the online machine learning algorithm can be a drift detector that detects whether ingested data marks the start of a change in the distribution of a time-series.

    Selecting actions responsive to computing environment incidents based on action impact information

    公开(公告)号:US10986120B2

    公开(公告)日:2021-04-20

    申请号:US16568949

    申请日:2019-09-12

    Applicant: Splunk Inc.

    Abstract: Systems, methods, and software described herein provide enhancements for implementing security actions in a computing environment. In one example, a method of operating an advisement system to provide actions in a computing environment includes identifying a security incident in the computing environment, identifying a criticality rating for the asset, and obtaining enrichment information for the security incident from one or more internal or external sources. The method also provides identifying a severity rating for the security incident based on the enrichment information, and determining one or more security actions based on the enrichment information. The method further includes identifying effects of the one or more security actions on operations of the computing environment based on the criticality rating and the severity rating, and identifying a subset of the one or more security actions to respond to the security incident based on the effects.

    Registry for mapping names to component instances using configurable bindings and pointer definitions

    公开(公告)号:US10983788B2

    公开(公告)日:2021-04-20

    申请号:US16262793

    申请日:2019-01-30

    Applicant: SPLUNK INC.

    Inventor: Itay A. Neeman

    Abstract: The disclosed embodiments relate to a system that facilitates developing applications in a component-based software development environment. This system provides an execution environment comprising instances of application components and a registry that maps names to instances of application components. Upon receiving a call to register a mapping between a name and an instance of an application component, the system updates the registry to include an entry for the mapping. Moreover, upon receiving a call to be notified about registry changes for a name, the system updates the registry to send a notification to a caller when a registry change occurs for the name.

Patent Agency Ranking