公开(公告)号：US11675816B1

公开(公告)日：2023-06-13

申请号：US17163258

申请日：2021-01-29

Applicant: Splunk Inc.

Inventor： Ramkumar Chandrasekharan ,  Tristan Antonio Fletcher ,  Ramprasad Siva Golla ,  Alpesh Sheth ,  Shailendra Suryawanshi ,  Xiang Zhou

IPC: G06F17/00 ,  G06F16/28 ,  G06N20/00

CPC classification number: G06F16/285 ,  G06N20/00

Abstract: Systems and methods are described for using a streaming data processor to group notable events reflecting operation of a computing system into episodes of related events reflecting an incident on the computing system, such as to enable root cause analysis of the incident. Each notable event can be generated based on one or more events detected within raw machine data. The streaming data processor can ingest a data stream of notable events, and apply a clustering algorithm to the events to cluster those events into episodes. When the episodes satisfy an action rule, the streaming data processor can take an action appropriate to that rule, such as transmitting an alert or programmatically altering operation of the computing system. The streaming data processor can utilize feedback as to the grouping of events into episodes to modify the clustering algorithm and improve accuracy of clustering.

公开(公告)号：US11676072B1

公开(公告)日：2023-06-13

申请号：US17163212

申请日：2021-01-29

Applicant: Splunk Inc.

Inventor： Ramkumar Chandrasekharan ,  William Deaderick ,  Lila Fridley ,  Ramprasad Siva Golla ,  Shailendra Suryawanshi

IPC: G06F7/00 ,  G06N20/00 ,  G06F3/0482 ,  G06F3/0486 ,  G06F16/28

CPC classification number: G06N20/00 ,  G06F3/0482 ,  G06F3/0486 ,  G06F16/285

Abstract: Systems and methods are described for training a machine learning (ML) model to group notable events reflecting operation of a computing system into episodes of related events reflecting an incident on the computing system, such as to enable root cause analysis of the incident. The ML model is trained using pairwise binary similarity labels (PBSLs) indicating that two events must or must not be grouped together. An interface is provided that facilitates rapid generating of PBSLs by relocating one or more events from a first episode to a second episode. The relocation input is translated into PBSLs that are then used to train the ML model.