# US 12,001,426 B1 · Supporting graph data structure transformations in graphs generated from a query to event data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,426 B1 - Document ID: US12001426B1 - Status: Granted - Kind: B1 - Application number: 18/295,567 - Filed: 2023-04-04 - Granted: 2024-06-04 - Earliest claimed: 2020-04-30 - Assignees: Splunk Inc. - Applicants: Splunk Inc. - Inventors: Chandrashekar Basavaiah; Elizabeth Li; Eric Tschetter; Joshua Walters - Web page: https://patentgrep.com/patent/US12001426B1 ## CPC - G06F 16/24526: {Internal representations for queries} - G06F 16/248: Presentation of query results - G06F 8/77: Software metrics - G06F 16/212: {with details for data modelling support} - G06F 16/2465: {Query processing support for facilitating data mining operations in structured databases} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are disclosed for supporting transformations of a graph generated from a query to event data. The event data may be unstructured event data, from which instances of a journey can be identified that represent sequences of related events describing actions performed in a computing environment. When evaluating journey instances, it can be helpful to visualize the instances as a graph. Depending on the instances viewed, a user may desire different modifications to the graph. While such modifications can be made when initially building instances from the unstructured event data, this can limit reuse of the resulting instances (since the modification would also be present when evaluating other subsets). To address this, embodiments of the present disclosure enable graph modifications to be applied to subsets of journey instances after building those instances from unstructured event data, increasing reuse of instances built from a query against the unstructured data. ## Claims ### Claim 1 A computer-implemented method, comprising: executing a query against a data store storing event data obtained from a computing environment, wherein the data store stores the event data as unstructured data, wherein the query obtains from the data store events describing one or more sequences of related steps performed in the computing environment, and wherein results from execution of the query represent the one or more sequences of related steps as structured data; modifying the structured data according to a transformation to produce modified structured data, the modified structured data representing a modified version of the one or more sequences of related steps, wherein modifying the structured data includes modifying events making up the one or more sequences of related steps; and outputting a graphical representation of the modified version of the one or more sequences of related steps. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the structured data indicates a number of instances of the one or more sequence of related steps occurring within the structured data. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes at least one of renaming a step within the one or more sequence of related steps, dividing the step into multiple steps, combining the step with an additional step within the one or more sequence of related steps, modifying an attribute of the step, or anonymizing data associated with the step. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes removing a step from the one or more sequence of related steps of related steps. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes removing a step from the one or more sequence of related steps and determining a number of instances of the one or more sequence of related steps occurring within the structured data with the step removed from the one or more sequence of related steps. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes adding a step to the one or more sequence of related steps. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes adding a step to the one or more sequence of related steps that is associated with a particular attribute value, and determining a number of instances, of the one or more sequence of related steps occurring within the structured data, with the attribute value. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes updating metrics associated with the structured data. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the transformation includes removing a loop within the one or more sequence of related steps, the loop corresponding a one or more steps performed repeatedly within the one or more sequence of related steps. ### Claim 10 (depends on 1) The computer-implemented method of claim 1 further comprising: identifying, from the structured data representing the one or more sequences of related steps, a subset of structured data that matches a filter criteria; modifying the subset of the structured data that matches the filter criteria according to a second transformation to result in a modified subset of structured data; and outputting a representation of the modified subset of structured data. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein identifying the subset of structured data that matches the filter criteria comprises executing a second query against the structured data. ### Claim 12 (depends on 10) The computer-implemented method of claim 10, wherein modifying the subset of structured data according to the transformation is responsive to a transformation command included within the query. ### Claim 13 (depends on 10) The computer-implemented method of claim 10, wherein the filter criteria specify at least one of: a step, a series of steps, an attribute value, a duration of sequences meeting the criteria, a duration between at least two steps, a repetition of at least one step, a start time, a stop time, a starting step, an ending step, or an ordering of at least two steps. ### Claim 14 (depends on 10) The computer-implemented method of claim 10, wherein the filter criteria comprise a plurality of sets of filter criteria each associated with a periodicity, wherein the method is repeated at each of a set of periods, and wherein the periods are determined based on a minimum periodicity among the plurality of sets of filter criteria. ### Claim 15 (depends on 10) The computer-implemented method of claim 10, wherein modifying the subset of structured data according to the transformation to produce the modified subset of structured data comprises modifying all sequences of related steps within the structured data according to the transformation to result in a modified set of structured data, and wherein identifying, from the structured data representing the one or more sequences of related steps, the subset of structured data representing the one or more sequence of related steps that matches the filter criteria comprises identifying the subset of structured data representing the one or more sequence of related steps that matches the filter criteria from within the modified set of structured data. ### Claim 16 A system comprising: a data store including computer-executable instructions; and a processor in communication with the data store and configured to execute the computer-executable instructions to: execute a query against a data store storing event data obtained from a computing environment, wherein the data store stores the event data as unstructured data, wherein the query obtains from the data store events describing one or more sequences of related steps performed in the computing environment, and wherein results from execution of the query represent the one or more sequences of related steps as structured data; modify the structured data according to a transformation to produce modified structured data, the modified structured data representing a modified version of the one or more sequences of related steps, wherein modifying the structured data includes modifying events making up the one or more sequences of related steps; and output a graphical representation of the modified version of the one or more sequences of related steps. ### Claim 17 (depends on 16) The system of claim 16, wherein the transformation includes removing a loop within the one or more sequence of related steps, the loop corresponding to one or more steps performed repeatedly within the one or more sequence of related steps. ### Claim 18 (depends on 16) The system of claim 16, wherein the processor is further configured to execute the computer-executable instructions to: identify, from the structured data representing the one or more sequences of related steps, a subset of structured data that matches a filter criteria; modify the subset of the structured data that matches a second filter criteria according to a second transformation to result in a modified subset of structured data; and output a representation of the modified subset of structured data. ### Claim 19 One or more non-transitory computer-readable media comprising computer-executable instructions that, when executed by a computing system, cause the computing system to: execute a query against a data store storing event data obtained from a computing environment, wherein the data store stores the event data as unstructured data, wherein the query obtains from the data store events describing one or more sequences of related steps performed in the computing environment, and wherein results from execution of the query represent the one or more sequences of related steps as structured data; modify the structured data according to a transformation to produce modified structured data, the modified structured data representing a modified version of the one or more sequences of related steps, wherein modifying the structured data includes modifying events making up the one or more sequences of related steps; and output a graphical representation of the modified version of the one or more sequences of related steps. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable media of claim 19, wherein the computer-executable instructions, when executed by the computing system, further cause the computing system to: identify a subset of structured data representing the one or more sequences of related steps that matches a filter criteria; and execute a second query against the structured data.