Field extraction rules from clustered data samples

    公开(公告)号:US11216491B2

    公开(公告)日:2022-01-04

    申请号:US15143563

    申请日:2016-04-30

    Applicant: Splunk Inc.

    Abstract: The operation of an automatic data input and query system is controlled by well-defined control data. Certain control data may relate to data schemas and direct operations performed by the system to extract fields from machine data. Automatic methods may determine proper field extraction control information by analyzing a sample of data from a source, breaking the sample data into event segments, classifying the segments into groups based on a measure of similarity, determining an operable extraction rule for each group, and storing the resulting extraction model. Data patterns known by the system can be leveraged to perform the event breaking and field identification for the classifying. Embodiments may provide a user interface to view, interact with, and approve the computer-generated extraction model.

    Field Extraction Rules from Clustered Data Samples

    公开(公告)号:US20170286525A1

    公开(公告)日:2017-10-05

    申请号:US15143563

    申请日:2016-04-30

    Applicant: Splunk Inc.

    CPC classification number: G06F16/287 G06F16/2477

    Abstract: The operation of an automatic data input and query system is controlled by well-defined control data. Certain control data may relate to data schemas and direct operations performed by the system to extract fields from machine data. Automatic methods may determine proper field extraction control information by analyzing a sample of data from a source, breaking the sample data into event segments, classifying the segments into groups based on a measure of similarity, determining an operable extraction rule for each group, and storing the resulting extraction model. Data patterns known by the system can be leveraged to perform the event breaking and field identification for the classifying. Embodiments may provide a user interface to view, interact with, and approve the computer-generated extraction model.

    DEFINING A SERVICE-MONITORING DASHBOARD USING KEY PERFORMANCE INDICATORS DERIVED FROM MACHINE DATA
    5.
    发明申请
    DEFINING A SERVICE-MONITORING DASHBOARD USING KEY PERFORMANCE INDICATORS DERIVED FROM MACHINE DATA 审中-公开
    使用从机器数据获取的主要性能指标来定义服务监控台

    公开(公告)号:US20160105329A1

    公开(公告)日:2016-04-14

    申请号:US14528926

    申请日:2014-10-30

    Applicant: Splunk Inc.

    Abstract: Processing device(s) cause display of a dashboard-creation graphical interface that includes a modifiable dashboard template and a key performance indicator (KPI)-selection interface for selecting a KPI indicating how a service provided by one or more entities is performing at one or more points in time. Each entity is associated with machine data. A KPI is defined by a search query that derives value(s) for the KPI from the machine data associated with the entities that provide the service. The processing device(s) receive through the KPI-selection interface a selection of a particular KPI and a selection of a location in the dashboard template corresponding to a location for displaying a KPI widget in a dashboard based on the dashboard template. The KPI widget provides a representation of value(s) for the particular KPI. The processing device(s) cause display of an identifier for the particular KPI at the location in the dashboard template.

    Abstract translation: 处理设备引起显示仪表板创建图形界面,其包括可修改的仪表板模板和关键性能指标(KPI)选择界面,用于选择指示如何由一个或多个实体提供的服务在一个或多个实体上执行的KPI 更多时间点 每个实体与机器数据相关联。 KPI由搜索查询定义,该搜索查询从与提供服务的实体相关联的机器数据中获取KPI的值。 处理设备通过KPI选择界面接收对基于仪表板模板在仪表板中显示KPI小部件的位置的对应于仪表板模板中的特定KPI的选择和选择。 KPI小部件提供特定KPI的值的表示。 处理设备导致在仪表板模板中的位置显示特定KPI的标识符。

    EXECUTING MODULAR ALERTS AND ASSOCIATED SECURITY ACTIONS

    公开(公告)号:US20210021614A1

    公开(公告)日:2021-01-21

    申请号:US16944433

    申请日:2020-07-31

    Applicant: Splunk Inc.

    Abstract: Techniques and mechanisms are disclosed for configuring actions to be performed by a network security application in response to the detection of potential security incidents, and for causing a network security application to report on the performance of those actions. For example, users may use such a network security application to configure one or more “modular alerts.” As used herein, a modular alert generally represents a component of a network security application which enables users to specify security modular alert actions to be performed in response to the detection of defined triggering conditions, and which further enables tracking information related to the performance of modular alert actions and reporting on the performance of those actions.

Patent Agency Ranking