Back to results
US 11,698,913 B2Granted
Cross-system journey monitoring based on relation of machine data
AssigneeSplunk he.
InventorsJoerg Beringer, Isabelle Park
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for cross-system journey modeling based on relation of machine data. An example method includes obtaining information describing a user journey that includes multiple steps, each step corresponding to a query to be applied to one or more field-searchable data stores storing events, each event including a portion of machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment, and each event being associated with a timestamp extracted from the portion of machine data of that event. Events returned as a result of the query of each step are related. The results of the relating are displayed.
Claims20
A computer-implemented method comprising:
- obtaining data describing a series of related steps, wherein each step of the series of related steps is associated with a query to be applied to events associated with a plurality of data sources, wherein a first event associated with a first data source of the plurality of data sources includes first information indicative of a first entity associated with the first event, wherein a second event associated with a second data source of the plurality of data sources includes second information indicative of a second entity associated with the second event, and wherein a stitching scheme defines relationships between steps of the series of related steps;
- relating, using the stitching scheme, a first set of events associated with the first data source to a second set of events associated with the second data source, wherein the stitching scheme relates the first set of events to the second set of events based on the first information included with the first set of events corresponding to the second information included with the second set of events, and wherein relating the first set of events to the second set of events produces a particular series of related steps associated with a particular entity;
- determining, using the stitching scheme, that one or more steps of the particular series of steps are one or more sub-steps of a particular step of the particular series of steps;
- and
- causing display of the particular series of steps, wherein the one or more sub-steps are displayed as nested within the particular step.
2 more elements
A computing system, comprising:
- one or more processing devices configured to:
- obtain data describing a series of related steps, wherein each step of the series of related steps is associated with a query to be applied to events associated with a plurality of data sources, wherein a first event associated with a first data source of the plurality of data sources includes first information indicative of a first entity associated with the first event, wherein a second event associated with a second data source of the plurality of data sources includes second information indicative of a second entity associated with the second event, and wherein a stitching scheme defines relationships between steps of the series of related steps;
- relate, using the stitching scheme, a first set of events associated with the first data source to a second set of events associated with the second data source, wherein the stitching scheme relates the first set of events to the second set of events based on the first information included with the first set of events corresponding to the second information included with the second set of events, and wherein relating the first set of events to the second set of events produces a particular series of related steps associated with a particular entity;
- determine, using the stitching scheme, that one or more steps of the particular series of steps are one or more sub-steps of a particular step of the particular series of steps;
- and
- cause display of the particular series of steps, wherein the one or more sub-steps are displayed as nested within the particular step.
3 more elements
Non-transitory computer readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to:
- obtain data describing a series of related steps, wherein each step of the series of related steps is associated with a query to be applied to events associated with a plurality of data sources, wherein a first event associated with a first data source of the plurality of data sources includes first information indicative of a first entity associated with the first event, wherein a second event associated with a second data source of the plurality of data sources includes second information indicative of a second entity associated with the second event, and wherein a stitching scheme defines relationships between steps of the series of related steps;
- relate, using the stitching scheme, a first set of events associated with the first data source to a second set of events associated with the second data source, wherein the stitching scheme relates the first set of events to the second set of events based on the first information included with the first set of events corresponding to the second information included with the second set of events, and wherein relating the first set of events to the second set of events produces a particular series of related steps associated with a particular entity;
- determine, using the stitching scheme, that one or more steps of the particular series of steps are one or more sub-steps of a particular step of the particular series of steps;
- and
- cause display of the particular series of steps, wherein the one or more sub-steps are displayed as nested within the particular step.
2 more elements
Dependencies are inferred from the claim text.