Using storage reactors to transform event data generated by remote capture agents
AssigneeSplunk Inc.
InventorMichael Dickey
Life of this patent
Estimating the term…
Abstract
The disclosed embodiments provide a method and system for processing network data. During operation, the system obtains, at a remote capture agent, configuration information for the remote capture agent from a configuration server over a network. Next, the system uses the configuration information to configure the generation of event data from network data obtained from network packets at the remote capture agent. The system then uses the configuration information to configure transformation of the event data or the network data into transformed event data at the remote capture agent.
Claims30
A computer-implemented method, comprising:
- receiving, by a configuration server, input specifying a setting related to transforming event data generated by a remote capture agent, wherein the setting identifies a type of storage destination from a plurality of supported types of storage destinations for storing the event data generated by the remote capture agent, and wherein the event data is associated with a first data format that is different from a second data format used by the type of storage destination identified by the setting;
- receiving event data generated by the remote capture agent, wherein the remote capture agent generates the event data based on network data monitored by the remote capture agent;
- transforming the event data into transformed event data, wherein the event data is transformed based on the second data format used by the type of storage destination identified by the setting;
- and
- sending the transformed event data to a storage destination associated with the type of storage destination identified by the setting.
A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:
- receiving input specifying a setting related to transforming event data generated by a remote capture agent, wherein the setting identifies a type of storage destination from a plurality of supported types of storage destinations for storing the event data generated by the remote capture agent, and wherein the event data is associated with a first data format that is different from a second data format used by the type of storage destination identified by the setting;
- receiving event data generated by the remote capture agent, wherein the remote capture agent generates the event data based on network data monitored by the remote capture agent;
- transforming the event data into transformed event data, wherein the event data is transformed based on the second data format used by the type of storage destination identified by the setting;
- and
- sending the transformed event data to a storage destination associated with the type of storage destination identified by the setting.
An apparatus, comprising:
- one or more processors;
- and
- a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, cause the apparatus to:
- receive input specifying a setting related to transforming event data generated by a remote capture agent, wherein the setting identifies a type of storage destination from a plurality of supported types of storage destinations for storing the event data generated by the remote capture agent, and wherein the event data is associated with a first data format that is different from a second data format used by the type of storage destination identified by the setting;
- receiving event data generated by the remote capture agent, wherein the remote capture agent generates the event data based on network data monitored by the remote capture agent;
- transform the event data into transformed event data, wherein the event data is transformed based on the second data format used by the type of storage destination identified by the setting;
- and
- send the transformed event data to a storage destination associated with the type of storage destination identified by the setting.
Dependencies are inferred from the claim text.