# US 11,113,342 B2 · Techniques for compiling and presenting query results > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,342 B2 - Document ID: US11113342B2 - Status: Granted - Kind: B2 - Application number: 15/663,596 - Filed: 2017-07-28 - Published: 2017-11-16 - Granted: 2021-09-07 - Earliest claimed: 2015-06-23 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Ramesh Panuganty - Web page: https://patentgrep.com/patent/US11113342B2 ## CPC - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 16/951: Indexing; Web crawling techniques - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Improved crawling and curation of data and metadata from diverse data sources is described. In some embodiments, improvements are achieved by interpreting the context, vocabulary and relationships of data element, to enable relational data search capability for users. The user querying process is improved by systematic identification of the data objects, context, and relationships across data objects and elements, aggregation methods and operators on the data objects and data elements as identified in the curation process. User query suggestions and recommendations can be adjusted based on the context, relationships between the data elements, user profile, and the data sources. When the user query is executed, the query text is translated into an equivalent of one or more query statements, such as SQL or PostGre statements, and the query is performed on the identified data sources. Results are assembled to present the answer in a meaningful visualization for the user query. ## Claims ### Claim 1 A system comprising: a memory including instructions; and a processor that is coupled to the memory and, when executing the instructions, is configured to perform the steps of: identifying one or more anomalies in monitored data and associated with a natural language search query based on the monitored data satisfying at least one threshold, wherein the at least one threshold is determined based on one or more patterns associated with a plurality of related attributes in the monitored data; and presenting, along with one or more results to the natural language search query, the one or more anomalies and at least one action or recommendation associated with the one or more anomalies. ### Claim 2 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to perform the steps of detecting critical anomalies and, responsive to detecting the critical anomalies, executing one or more remediation actions. ### Claim 3 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to provide an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and at least some of the data sources are public data sources. ### Claim 4 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to provide an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and at least some of the data sources are non-public data sources. ### Claim 5 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to provide an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and the data sources comprise relational data sources and non-relational data sources. ### Claim 6 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to provide an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and providing the ability to search or filter services or associated data sources comprises providing related searches associated with the previously-occurred anomalies. ### Claim 7 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to provide an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and providing the ability to search or filter services or associated data sources comprises providing one or more filters based on the threshold. ### Claim 8 (depends on 7) The system as described in claim 7, wherein the one or more filters comprise a range filter. ### Claim 9 (depends on 7) The system as described in claim 7, wherein the one or more filters comprise a minimum or maximum value filter. ### Claim 10 (depends on 1) The system as described in claim 1, wherein the processor, when executing the instructions, is further configured to aggregate and identify correlated data to present suggestions to a user associated with the natural language query, and the correlated data have a parent-child relationship. ### Claim 11 A computer-implemented method, comprising: identifying one or more anomalies in monitored data and associated with a natural language search query based on the monitored data satisfying at least one threshold, wherein the at least one threshold is determined based on one or more patterns associated with a plurality of related attributes in the monitored data; and presenting, along with one or more results to the natural language search query, the one or more anomalies and at least one action or recommendation associated with the one or more anomalies. ### Claim 12 (depends on 11) A method as described in claim 11, further comprising detecting critical anomalies and, responsive to detecting the critical anomalies, executing one or more remediation actions. ### Claim 13 (depends on 11) A method as described in claim 11, further comprising providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, wherein at least some of the data sources are public data sources. ### Claim 14 (depends on 11) A method as described in claim 11, further comprising providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, wherein at least some of the data sources are non-public data sources. ### Claim 15 (depends on 11) A method as described in claim 11, further comprising providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, wherein the data sources comprise relational data sources and non-relational data sources. ### Claim 16 (depends on 11) A method as described in claim 11, further comprising providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, wherein providing the ability to search or filter services or associated data sources comprises providing related searches associated with the previously-occurred anomalies. ### Claim 17 (depends on 11) A method as described in claim 11, further comprising providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, wherein providing the ability to search or filter services or associated data sources comprises providing one or more filters based on the threshold. ### Claim 18 (depends on 17) A method as described in claim 17, wherein the one or more filters comprise a range filter. ### Claim 19 (depends on 17) A method as described in claim 17, wherein the one or more filters comprise a minimum or maximum value filter. ### Claim 20 (depends on 11) A method as described in claim 11, further comprising aggregating and identifying correlated data to present suggestions to a user associated with a natural language query, wherein the correlated data have a parent-child relationship. ### Claim 21 One or more computer-readable storage media storing instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising: identifying one or more anomalies in monitored data and associated with a natural language search query based on the monitored data satisfying at least one threshold, wherein the at least one threshold is determined based on one or more patterns associated with a plurality of related attributes in the monitored data; and presenting, along with one or more results to the natural language search query, the one or more anomalies and at least one action or recommendation associated with the one or more anomalies. ### Claim 22 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise detecting critical anomalies and, responsive to detecting the critical anomalies, executing one or more remediation actions. ### Claim 23 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and at least some of the data sources are public data sources. ### Claim 24 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and at least some of the data sources are non-public data sources. ### Claim 25 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and the data sources comprise relational data sources and non-relational data sources. ### Claim 26 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and providing the ability to search or filter services or associated data sources comprises providing related searches associated with the previously-occurred anomalies. ### Claim 27 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise providing an ability to search or filter servers or associated data sources by referencing previously-occurred anomalies, and providing the ability to search or filter services or associated data comprises providing one or more filters based on the threshold. ### Claim 28 (depends on 27) The one or more computer-readable storage media as described in claim 27, wherein the one or more filters comprise a range filter. ### Claim 29 (depends on 27) The one or more computer-readable storage media as described in claim 27, wherein the one or more filters comprise a minimum or maximum value filter. ### Claim 30 (depends on 21) The one or more computer-readable storage media as described in claim 21, wherein the operations further comprise aggregating and identifying correlated data to present suggestions to a user associated with a natural language query, and the correlated data have a parent-child relationship.