# US 12,217,106 B2 · Auto-discovery of sequential, transactional milestones in application observability data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,217,106 B2 - Document ID: US12217106B2 - Status: Granted - Kind: B2 - Application number: 18/213,513 - Filed: 2023-06-23 - Published: 2024-12-26 - Granted: 2025-02-04 - Earliest claimed: 2023-06-23 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Jaideep Padhye; Tom Thekkel Jose - Web page: https://patentgrep.com/patent/US12217106B2 ## CPC - G06F 9/542: {Event management; Broadcasting; Multicasting; Notifications} - G06F 11/3438: {monitoring of user actions (tracking the activity of the user H04L67/535)} - G06F 11/302: {where the computing system component is a software system} - G06F 11/324: {Display of status information} - G06F 11/3476: {Data logging (G06F11/14, G06F11/2205 take precedence)} - G06F 11/3495: {for systems} - G06Q 10/06393: {Score-carding, benchmarking or key performance indicator [KPI] analysis} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - G06F 2201/835: Timestamp - G06F 2201/86: Event-based monitoring - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a device determines one or more key-value pairs associated with observability data for an online application, and searches the observability data for events corresponding to the one or more key-value pairs. The device also builds a responsive event list with the events corresponding to the one or more key-value pairs within the observability data and sorts the responsive event list by associated timestamps to provide the responsive event list as a sequence of transactional milestones reached by one or more users of the online application. ## Claims ### Claim 1 A method, comprising: determining, by a process, one or more key-value pairs associated with observability data for an online application comprising metrics, events, logs, or traces that are collected based on tests initiated by one or more agents that are part of an observability intelligence platform and are each installed on a network browser, computing device, or a server by: identifying a start time and an end time within the observability data; finding all key-value pairs within the start time and the end time within the observability data, selecting only key-value pairs based on a cardinality associated with the one or more key-value pairs; searching, by the process, the observability data for events corresponding to the one or more key-value pairs; building, by the process, a responsive event list with the events corresponding to the one or more key-value pairs within the observability data; and sorting, by the process, the responsive event list by associated timestamps to provide the responsive event list as a sequence of transactional milestones reached by one or more users of the online application. ### Claim 2 (depends on 1) The method of claim 1, wherein the observability data comprises metrics, events, logs, and traces. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating a graphical visualization for a user interface to provide the responsive event list as the sequence of transactional milestones reached by one or more users of the online application. ### Claim 4 (depends on 3) The method of claim 3, wherein the graphical visualization portrays one or more customized milestones. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining, by the process, the one or more key-value pairs by identifying specific key-value pairs. ### Claim 6 (depends on 5) The method of claim 5, further comprising: listing the one or more key-value pairs based on a report corresponding to the observability data. ### Claim 7 (depends on 5) The method of claim 5, wherein the one or more key-value pairs are identified or selected, or both, by a user. ### Claim 8 (depends on 1) The method of claim 1, wherein the one or more key-value pairs comprises all the key-value pairs. ### Claim 9 (depends on 1) The method of claim 1, wherein the start time or the end time, or both, are selected by a user. ### Claim 10 (depends on 1) The method of claim 1, wherein determining the one or more key-value pairs further comprises: identifying a length of time; buffering streaming observability data for the length of time; finding all key-value pairs within the streaming observability data during the length of time; and selecting one or more of the key-value pairs to search. ### Claim 11 (depends on 10) The method of claim 10, wherein determining the one or more key-value pairs further comprises: collecting all active key-value pairs; and selecting distinct key-value pairs to search. ### Claim 12 (depends on 10) The method of claim 10, wherein collecting all active key-value pairs further comprises: collecting all key-value pairs up to a threshold number of milestones and discarding key-value pairs past the threshold number of milestones. ### Claim 13 (depends on 10) The method of claim 10, further comprising: maintaining a reverse index of all key-value pairs seen within the length of time in fields of different events. ### Claim 14 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising: determining one or more key-value pairs associated with observability data for an online application comprising metrics, events, logs, or traces that are collected based on tests initiated by one or more agents that are part of an observability intelligence platform and are each installed on a network browser, computing device, or a server by: identifying a start time and an end time within the observability data; finding all key-value pairs within the start time and the end time within the observability data, selecting only key-value pairs based on a cardinality associated with the one or more key-value pairs; searching the observability data for events corresponding to the one or more key-value pairs; building a responsive event list with the events corresponding to the one or more key-value pairs within the observability data; and sorting the responsive event list by associated timestamps to provide the responsive event list as a sequence of transactional milestones reached by one or more users of the online application. ### Claim 15 (depends on 14) The tangible, non-transitory, computer-readable medium as in claim 14, wherein the process further comprises: determining the one or more key-value pairs by identifying specific key-value pairs. ### Claim 16 (depends on 14) The tangible, non-transitory, computer-readable medium as in claim 14, wherein the process further comprises: identifying a length of time; buffering streaming observability data for the length of time; finding all key-value pairs within the streaming observability data during the length of time; and selecting one or more of the key-value pairs to search. ### Claim 17 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute one or more processes; and a memory configured to store a process that is executable by the processor, the process, when executed, configured to: determine one or more key-value pairs associated with observability data for an online application comprising metrics, events, logs, or traces that are collected based on tests initiated by one or more agents that are part of an observability intelligence platform and are each installed on a network browser, computing device, or a server by: identifying a start time and an end time within the observability data; finding all key-value pairs within the start time and the end time within the observability data, selecting only key-value pairs based on a cardinality associated with the one or more key-value pairs; search the observability data for events corresponding to the one or more key-value pairs; build a responsive event list with the events corresponding to the one or more key-value pairs within the observability data; and sort the responsive event list by associated timestamps to provide the responsive event list as a sequence of transactional milestones reached by one or more users of the online application.