Intent-based analytics

A system for network analysis, comprising:

• one or more processors configured to:
• receive, for a collector element, a first declarative specification that specifies a dynamically updating query associated with networking components of a computer network, wherein the query identifies criteria that match a portion of the computer network and the collector element is capable of implementing a variety of different queries including the received dynamically updating query;
• receive, for a processing element, a second declarative specification, wherein the processing element is configured to receive dynamically updated results of the dynamically updating query of the collector element and dynamically process the dynamically updated results of the dynamically updating query;
• execute at least the collector element and the processing element as separate elements to implement the dynamically updating query based on the first declarative specification and process the dynamically updated results of the dynamically updating query based on the second declarative specification, including by being configured to, in response to a detected change in the network that would affect the dynamically updating query, identify that the collector element and/or the processing element is affected by the detected change and enable the collector element and/or the processing element to automatically and dynamically adapt to the detected change, wherein the dynamically updated results are to be updated due to the detected change in the network;
• and
• provide an indication of a detected anomaly based at least in part on the updated dynamically updated results of the dynamically updating query;
• and
• a memory coupled to at least one of the one or more processors and configured to provide at least one of the one or more processors with instructions.

A computer program product for network analysis, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving, for a collector element, a first declarative specification that specifies a dynamically updating query associated with networking components of a computer network, wherein the query identifies criteria that match a portion of the computer network and the collector element is capable of implementing a variety of different queries including the received dynamically updating query;
• receiving, for a processing element, a second declarative specification, wherein the processing element is configured to receive dynamically updated results of the dynamically updating query of the collector element and dynamically process the dynamically updated results of the dynamically updating query;
• executing at least the collector element and the processing element as separate elements to implement the dynamically updating query based on the first declarative specification and process the dynamically updated results of the dynamically updating query based on the second declarative specification, including by in response to a detected change in the network that would affect the dynamically updating query, identifying that the collector element and/or the processing element is affected by the detected change and enabling the collector element and/or the processing element to automatically and dynamically adapt to the detected change, wherein the dynamically updated results are updated due to the detected change in the network;
• and
• providing an indication of a detected anomaly based at least in part on the updated dynamically updated results of the dynamically updating query.