US 12,182,174 B1Granted

Exploratory data analysis system for generation of wildcards within log templates through log clustering and analysis thereof

AssigneeSplunk Inc.

InventorsFrancis Beckert, Kristal Curtis, Om Rajyaguru, Abraham Starosta, Poonam Yadav

Life of this patent

Estimating the term…

Loading patent…

Abstract

A search assistant engine is described that integrates with a data intake and query system and provides an intuitive user interface to assist a user in searching and evaluating indexed event data. Additionally, the search assistant engine provides logic to intelligently provide data to the user through the user interface such as determining fields of events likely to be of interest based on determining a mutual information score for each field and determining groups of related fields based on determining a mutual information score for each field grouping. Some implementations utilize machine learning techniques in certain analyses such as when clustering events and determining an event templates for each cluster. Additionally, the search assistant engine may import terms or characters from user interaction into predetermined search query templates to generate tailored search query for the user.

Claims20

Dependent claims

A computerized method comprising:

obtaining a plurality of events;
generating a cluster assignment for each event of the plurality of events, wherein the generating of the cluster assignment includes assigning one or more events of the plurality of events to each of a plurality of clusters of events including a first cluster of events and a second cluster of events;
generating an event template for each of the plurality of clusters, wherein the generating of the event template includes operations of:
extracting a set of static terms and a set of wildcards within the one or more events of the event template,
determining event fields that correspond to each of the set of wildcards, and
populating the event template with the set of static terms and the event fields corresponding to each of the set of wildcards, wherein an ordering of the static terms and the event fields corresponds to an order of terms of the plurality of events;
causing a first display of the event template for each of the plurality of clusters of events on a user interface rendered on a display screen of a network device;
and
responsive to selection of a first event template associated with the first cluster of events, generating a second display configured to render a visual measure for identifying a level or amount of information that a first event of the event fields associated with the first cluster of events provides about other event fields of the first cluster of events.

6 more elements

A computing device, comprising:

a processor;
and
a non-transitory computer-readable medium having stored thereon instructions that, when executed by the processor, cause the processor to perform operations including:
obtaining a plurality of events;
generating a cluster assignment for each event of the plurality of events, wherein the generating of the cluster assignment includes assigning one or more events of the plurality of events to each of a plurality of clusters of events including a first cluster of events and a second cluster of events;
generating an event template for each of the plurality of clusters, wherein the generating of the event template includes operations of:
extracting a set of static terms and a set of wildcards within the one or more events of the event template,
determining event fields that correspond to each of the set of wildcards, and
populating the event template with the set of static terms and the event fields corresponding to each of the set of wildcards, wherein an ordering of the static terms and the event fields corresponds to an order of terms of the plurality of events;
causing a first display of the event template for each of the plurality of clusters of events on a user interface rendered on a display screen of a network device;
and
responsive to selection of a first event template associated with the first cluster of events, generating a second display configured to render a visual measure for identifying a level or amount of information that a first event of the event fields associated with the first cluster of events provides about other event fields of the first cluster of events.

9 more elements

A non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more processors, cause the one or more processor to perform operations including:

obtaining a plurality of events;
generating a cluster assignment for each event of the plurality of events, wherein the generating of the cluster assignment includes assigning one or more events of the plurality of events to each of a plurality of clusters of events including a first cluster of events and a second cluster of events;
generating an event template for each of the plurality of clusters, wherein the generating of the event template includes operations of:
extracting a set of static terms and a set of wildcards within the one or more events of the event template,
determining event fields that correspond to each of the set of wildcards, and
populating the event template with the set of static terms and the event fields corresponding to each of the set of wildcards, wherein an ordering of the static terms and the event fields corresponds to an order of terms of the plurality of events;
causing a first display of the event template for each of the plurality of clusters of events on a user interface rendered on a display screen of a network device;
and
responsive to selection of a first event template associated with the first cluster of events, generating a second display configured to render a visual measure for identifying a level or amount of information that a first event of the event fields associated with the first cluster of events provides about other event fields of the first cluster of events.

6 more elements

Dependencies are inferred from the claim text.