# US 12,222,840 B1 · Generating span related metric data streams by an analytic engine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,222,840 B1 - Document ID: US12222840B1 - Status: Granted - Kind: B1 - Application number: 17/974,262 - Filed: 2022-10-26 - Granted: 2025-02-11 - Earliest claimed: 2020-03-30 - Assignees: Splunk Inc. - Applicants: SPLUNK Inc. - Inventors: Steven Karis; Maxime Petazzoni; Matthew William Pound; Joseph Ari Ross; Charles Smith; Scott Stewart - Web page: https://patentgrep.com/patent/US12222840B1 ## CPC - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 11/3636: {by tracing the execution of the program} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3409: {for performance assessment} - G06F 11/3452: {Performance evaluation by statistical analysis} - G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)} - G06F 11/3644: {by instrumenting at runtime} - G06F 16/24568: {Data stream processing; Continuous queries} - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method of generating metrics data associated with a microservices-based application comprises ingesting a plurality of spans and mapping an ingested span of the plurality of spans to a span identity, wherein the span identity comprises a tuple of information identifying a type of span associated with the span identity, wherein the tuple of information comprises user-configured dimensions. The method further comprises grouping the ingested span by the span identity, wherein the ingested span is grouped with other spans from the plurality of spans comprising a same span identity. The method also comprises computing metrics associated with the span identity and using the metrics to generate a stream of metric data associated with the span identity. ## Claims ### Claim 1 A method of generating metrics data associated with a microservices-based application, the method comprising: ingesting a plurality of spans associated with one or more applications executing in a distributed computing environment; mapping each span of the plurality of spans to a span identity that corresponds to a type of span; grouping the plurality of spans based on the span identity associated with each span of the plurality of spans; computing metrics associated with the span identity by aggregating information extracted from spans associated with the span identity; generating, based on the metrics, a stream of metric data associated with the span identity; generating an alert signal based on values associated with the stream of metric data satisfying a condition; and responsive to generating the alert signal, extending the span identity with user-configured tags to extract information regarding an operation associated with the span identity. ### Claim 2 (depends on 1) The method of claim 1, wherein each of the plurality of spans includes a plurality of attributes and one or more user-configured tags. ### Claim 3 (depends on 1) The method of claim 1, wherein the condition corresponds to at least one value of the stream of metric data exceeding a predetermined threshold. ### Claim 4 (depends on 2) The method of claim 2, wherein the plurality of attributes includes: an operation name, a service name, a kind tag, an error flag, or a flag indicating if the span is part of a service mesh. ### Claim 5 (depends on 1) The method of claim 1, wherein the metrics computed are selected from one or more of a minimum span duration, a median span duration, a maximum span duration, a p90 latency value, a p99 latency value, and a count of spans associated with the span identity. ### Claim 6 (depends on 1) The method of claim 1, wherein an analytic engine computes the metrics periodically for a given number of time-periods, and wherein the analytic engine resets the metrics at an end of each time-period. ### Claim 7 (depends on 6) The method of claim 6, wherein the analytic engine resides in a cloud network. ### Claim 8 (depends on 1) The method of claim 1, wherein the step of computing metrics further comprises: generating a fixed size bin histogram for the span identity; inserting values associated with each span corresponding to the span identity in respective bins of the fixed size bin histogram; and computing the metrics by tracking counts associated with each bin in the fixed size bin histogram. ### Claim 9 (depends on 1) The method of claim 1, further comprising: determining whether the span identity is associated with a cross-service call; and responsive to a determination that the span identity is associated with a cross-service call, extending the span identity with user-configured tags to extract information regarding the cross-service call. ### Claim 10 (depends on 1) The method of claim 1, further comprising: rendering, in a user interface, an application topology graph depicting metrics corresponding to a plurality of services associated with one or more applications executing in the distributed computing environment. ### Claim 11 A non-transitory computer-readable medium having computer-readable program code embodied therein for causing a computer system to perform a method of generating metrics data associated with a microservices-based application, the method comprising: ingesting a plurality of spans associated with one or more applications executing in a distributed computing environment; mapping each span of the plurality of spans to a span identity that corresponds to a type of span; grouping the plurality of spans based on the span identity associated with each span of the plurality of spans; computing metrics associated with the span identity by aggregating information extracted from spans associated with the span identity; generating, based on the metrics, a stream of metric data associated with the span identity; generating an alert signal based on values associated with the stream of metric data satisfying a condition; and responsive to generating the alert signal, extending the span identity with user-configured tags to extract information regarding an operation associated with the span identity. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein each of the plurality of spans includes a plurality of attributes and one or more user-configured tags. ### Claim 13 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the condition corresponds to at least one value of the stream of metric data exceeding a predetermined threshold. ### Claim 14 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the metrics computed are selected from one or more of a minimum span duration, a median span duration, a maximum span duration, a p90 latency value, a p99 latency value, and a count of spans associated with the span identity. ### Claim 15 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein an analytic engine computes the metrics periodically for a given number of time-periods, and wherein the analytic engine resets the metrics at an end of each time-period. ### Claim 16 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the step of computing metrics further comprises: generating a fixed size bin histogram for the span identity; inserting values associated with each span corresponding to the span identity in respective bins of the fixed size bin histogram; and computing the metrics by tracking counts associated with each bin in the fixed size bin histogram. ### Claim 17 A system for performing a method of generating metrics data associated with a microservices-based application, the system comprising: a processing device communicatively coupled with a memory and configured to: ingest a plurality of spans associated with one or more applications executing in a distributed computing environment; map each span of the plurality of spans to a span identity that corresponds to a type of span; group the plurality of spans based on the span identity associated with each span of the plurality of spans; compute metrics associated with the span identity by aggregating information extracted from spans associated with the span identity; generate, based on the metrics, a stream of metric data associated with the span identity; generate an alert signal based on values associated with the stream of metric data satisfying a condition; and extend the span identity with user-configured tags to extract information regarding an operation associated with the span identity in response to the alert signal being generated. ### Claim 18 (depends on 17) The system of claim 17, wherein the metrics computed are selected from one or more of a minimum span duration, a median span duration, a maximum span duration, a p90 latency value, a p99 latency value, and a count of spans associated with the span identity.