# US 10,374,883 B2 · Application-based configuration of network data capture by remote capture agents > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,883 B2 - Document ID: US10374883B2 - Status: Granted - Kind: B2 - Application number: 15/885,712 - Filed: 2018-01-31 - Published: 2018-06-14 - Granted: 2019-08-06 - Earliest claimed: 2014-04-15 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Michael Dickey - Web page: https://patentgrep.com/patent/US10374883B2 ## CPC - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/0856: {by backing up or archiving configuration information} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed embodiments provide a method and system for facilitating the processing of network data. During operation, the system obtains, at a remote capture agent, configuration information for the remote capture agent from a configuration server over a network. Next, the system uses the configuration information to configure the generation of event data from network packets at the remote capture agent. Upon receiving an update to the configuration information from the configuration server, the system uses the update to reconfigure the generation of the event data by the remote capture agent during runtime of the remote capture agent. ## Claims ### Claim 1 A computer-implemented method performed by a configuration server coupled to a network, the method comprising: obtaining configuration information generated and sent to the configuration server by an application running on a server that is separate from the configuration server and that is coupled to the configuration server via the network, the configuration information specifying one or more event streams to be generated by one or more remote capture agents, the one or more event streams including timestamped event data generated by the one or more remote capture agents based on network traffic monitored by the one or more remote capture agents, and wherein the one or more remote capture agents are installed in a virtual computing environment; and sending the configuration information to the one or more remote capture agents, the configuration information causing the one or more remote capture agents to: generate the one or more event streams including timestamped event data generated based on network traffic monitored by the one or more remote capture agents, and send the one or more event streams to another component on the network for storage in a data store accessible to the application. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the configuration information causes the one or more remote capture agents to generate each event of the timestamped event data by: identifying boundaries of the event in the network traffic; extracting network packet data from at least one network packet of the network traffic and associating the network packet data with the event; determining a timestamp associated with the event; and associating the timestamp with the event. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the configuration information further causes the one or more remote capture agents to generate each event of the timestamped event data by: extracting network packet data from at least one network packet of the network traffic and associating the network packet data with the event; applying a filtering rule to the network packet data to determine an event type associated with the event; and adding, based on the determined event type, the event to at least one event stream of one or more event streams. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the application uses the one or more event streams to satisfy search requests for data contained in the one or more event streams. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the application uses the one or more event streams to generate visualizations based on timestamped event data contained in the one or more event streams. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the configuration information specifies one or more transformations to be applied to the timestamped event data, and wherein the one or more transformations comprise at least one of an aggregation, a calculation, a filter, a normalization, and a formatting. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the configuration information comprises at least one of an identifier for an event stream, a description for the event stream, an event stream type for the event stream, a custom field for the event stream, and an additional parameter for the event stream. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the configuration information comprises an additional parameter, and wherein the additional parameter is at least one of a time interval between events, a maximum number of aggregated events, and an inclusion of a matching transaction or matching error in the event data. ### Claim 9 A configuration server coupled to a network, the configuration server comprising: a processor; a non-transitory computer readable storage medium storing instructions which, when executed by the processor, cause the configuration server to: obtain configuration information generated and sent to the configuration server by an application running on a server that is separate from the configuration server and that is coupled to the configuration server via the network, the configuration information specifying one or more event streams to be generated by one or more remote capture agents, the one or more event streams including timestamped event data generated by the one or more remote capture agents based on network traffic monitored by the one or more remote capture agents, and wherein the one or more remote capture agents are installed in a virtual computing environment; and send the configuration information to the one or more remote capture agents, the configuration information causing the one or more remote capture agents to: generate the one or more event streams including timestamped event data generated based on network traffic monitored by the one or more remote capture agents, and send the one or more event streams to another component on the network for storage in a data store accessible to the application. ### Claim 10 (depends on 9) The configuration server of claim 9, wherein the configuration information further causes the one or more remote capture agents to generate each even of the timestamped event data by: identifying boundaries of the event in the network traffic; extracting network packet data from at least one network packet of the network traffic and associating the network packet data with the event; determining a timestamp associated with the event; and associating the timestamp with the event. ### Claim 11 (depends on 9) The configuration server of claim 9, wherein the configuration information further causes the one or more remote capture agents to generate each event of the timestamped event data by: extracting network packet data from at least one network packet of the network traffic and associating the network packet data with the event; applying a filtering rule to the network packet data to determine an event type associated with the event; and adding, based on the determined event type, the event to at least one event stream of one or more event streams. ### Claim 12 (depends on 9) The configuration server of claim 9, wherein the application uses the one or more event streams to satisfy search requests for data contained in the one or more event streams. ### Claim 13 (depends on 9) The configuration server of claim 9, wherein the application uses the one or more event streams to generate visualizations based on timestamped event data contained in the one or more event streams. ### Claim 14 (depends on 9) The configuration server of claim 9, wherein the configuration information specifies one or more transformations to be applied to the timestamped event data, and wherein the one or more transformations comprise at least one of an aggregation, a calculation, a filter, a normalization, and a formatting. ### Claim 15 (depends on 9) The configuration server of claim 9, wherein the configuration information comprises at least one of an identifier for an event stream, a description for the event stream, an event stream type for the event stream, a custom field for the event stream, and an additional parameter for the event stream. ### Claim 16 (depends on 9) The configuration server of claim 9, wherein the configuration information comprises an additional parameter, and wherein the additional parameter is at least one of a time interval between events, a maximum number of aggregated events, and an inclusion of a matching transaction or matching error in the event data. ### Claim 17 A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause a configuration server to perform operations comprising: obtaining configuration information generated and sent to the configuration server by an application running on a server that is separate from the configuration server and that is coupled to the configuration server via the network, the configuration information specifying one or more event streams to be generated by one or more remote capture agents, the one or more event streams including timestamped event data generated by the one or more remote capture agents based on network traffic monitored by the one or more remote capture agents, and wherein the one or more remote capture agents are installed in a virtual computing environment; and sending the configuration information to the one or more remote capture agents, the configuration information causing the one or more remote capture agents to: generate the one or more event streams including timestamped event data generated based on network traffic monitored by the one or more remote capture agents, and send the one or more event streams to another component on the network for storage in a data store accessible to the application. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the configuration information causes the one or more remote capture agents to generate each event of the timestamped event data by: identifying boundaries of the event in the network traffic; extracting network packet data from at least one network packet of the network traffic and associating the network packet data with the event; determining a timestamp associated with the event; and associating the timestamp with the event. ### Claim 19 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the configuration information further causes the one or more remote capture agents to generate each event of the timestamped event data by: extracting network packet data from at least one network packet of the network traffic and associating the network packet data with the event; applying a filtering rule to the network packet data to determine an event type associated with the event; and adding, based on the determined event type, the event to at least one event stream of one or more event streams. ### Claim 20 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the application uses the one or more event streams to satisfy search requests for data contained in the one or more event streams. ### Claim 21 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the application uses the one or more event streams to generate visualizations based on timestamped event data contained in the one or more event streams. ### Claim 22 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the configuration information specifies one or more transformations to be applied to the timestamped event data, and wherein the one or more transformations comprise at least one of an aggregation, a calculation, a filter, a normalization, and a formatting. ### Claim 23 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the configuration information comprises at least one of an identifier for an event stream, a description for the event stream, an event stream type for the event stream, a custom field for the event stream, and an additional parameter for the event stream. ### Claim 24 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the configuration information comprises an additional parameter, and wherein the additional parameter is at least one of a time interval between events, a maximum number of aggregated events, and an inclusion of a matching transaction or matching error in the event data.