Automatic entity definitions
AssigneeSplunk Inc.
InventorsArun Ramani, Anupadmaja Raghavan, Tristan Antonio Fletcher, Marc Chene
Life of this patent
Estimating the term…
Abstract
Methods are disclosed to take advantage of the early collection of machine data from a new or changed entity in a computing environment in order to update the definitional information about entities used by a service monitoring system. In some embodiments, the process undertaken to recognize new or changed entities in an IT environment from collected machine data may be informed by the expertise of a particular subject matter area by installing that intelligence in a codified form packaged as a domain add-on to the service monitoring system.
Claims31
-30. (canceled)
The method comprising:
- receiving and storing machine data from a plurality of data sources over a period of time;
- identifying an entity having information generated by or about the entity among the machine data, and having no corresponding entity definition;
- deriving content descriptive of the entity from the information generated by or about the entity;
- and
- storing an entity definition corresponding to the entity based at least in part on the derived content, the entity definition identifying machine data pertaining to the entity;
- wherein the entity performs a service and the service has a key performance indicator (KPI) defined by a first search query that derives a value indicative of the performance of the service at a point in time or during a period of time, the value derived from machine data identified in entity definitions for one or more entities that provide the service;
- wherein the method is performed by a computer system comprising one or more processors.
The method of claim 1 wherein the information generated by or about the entity comprises data generated by the entity.
The method of claim 1 wherein the information generated by or about the entity comprises data generated by a machine other than the entity.
The method of claim 1 wherein the information generated by or about the entity comprises data generated by the entity and a machine other than the entity.
The method of claim 1 wherein the content descriptive of the entity includes an identifier.
The method of claim 1 wherein the content descriptive of the entity includes an alias.
The method of claim 1 wherein the content descriptive of the entity includes at least one from among a network address, a host name, and an identifier number.
The method of claim 1 wherein the deriving content descriptive of the entity includes extracting information from machine data from multiple sources.
The method of claim 1 wherein the identifying an entity having information generated by or about the entity among the machine data comprises accessing the machine data using a late-binding schema.
The method of claim 1 wherein the storing machine data comprises storing machine data as timestamped events.
The method of claim 1 wherein the storing machine data comprises storing machine data as timestamped events each having a segment of raw machine data.
The method of claim 1 wherein deriving content descriptive of the entity includes executing a second search query.
The method of claim 1 wherein deriving the content descriptive of the entity includes executing a second search query to produce a search result set in tabular form.
The method of claim 1 wherein deriving the content descriptive of the entity includes executing a second search query to produce a search result set having an entry corresponding to the entity.
The method of claim 1 wherein deriving the content descriptive of the entity includes executing a second search query to produce a search result set;
- and wherein the storing an entity definition includes processing the search result set as an input.
The method of claim 1 wherein deriving the content descriptive of the entity includes executing a second search query to produce a search result set having an entry corresponding to the entity, the entry having one or more data items.
The method of claim 1 wherein deriving the content descriptive of the entity includes executing a second search query to produce a search result set having an entry corresponding to the entity, the entry having one or more data items, and the position of each data item in the entry indicating an element of the entity definition.
The method of claim 1 further comprising causing display of a graphical user interface (GUI) having information from the entity definition including at least one from among a name, an alias, and an information field.
The method of claim 1 further comprising:
- determining whether the entity definition satisfies filter criteria for identifying entities associated with the service.
The method of claim 1 further comprising:
- determining whether the entity definition satisfies filter criteria for identifying entities associated with the service;
- and
- associating the entity definition with a service definition for the service in accordance with said determining.
The method of claim 1 wherein the identifying an entity is performed automatically in accordance with a frequency or schedule.
A system comprising:
- a memory;
- and
- a processing device coupled with the memory to:
- receive and store machine data from a plurality of data sources over a period of time;
- identify an entity having information generated by or about the entity among the machine data, and having no corresponding entity definition;
- derive content descriptive of the entity from the information generated by or about the entity;
- and
- store an entity definition corresponding to the entity based at least in part on the derived content, the entity definition identifying machine data pertaining to the entity;
- wherein the entity performs a service and the service has a key performance indicator (KPI) defined by a first search query that derives a value indicative of the performance of the service at a point in time or during a period of time, the value derived from machine data identified in entity definitions for one or more entities that provide the service.
The system of claim 22 wherein to derive content descriptive of the entity includes extracting information from machine data from multiple sources.
The system of claim 22 wherein to identify an entity having information generated by or about the entity among the machine data comprises accessing the machine data using a late-binding schema.
The system of claim 22 wherein to store machine data comprises storing machine data as timestamped events each having a segment of raw machine data.
The system of claim 22 further comprising to:
- make a determination whether the entity definition satisfies filter criteria for identifying entities associated with the service;
- and
- associate the entity definition with a service definition for the service in accordance with said determination.
A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing device to perform operations comprising:
- receiving and storing machine data from a plurality of data sources over a period of time;
- identifying an entity having information generated by or about the entity among the machine data, and having no corresponding entity definition;
- deriving content descriptive of the entity from the information generated by or about the entity;
- and
- storing an entity definition corresponding to the entity based at least in part on the derived content, the entity definition identifying machine data pertaining to the entity;
- wherein the entity performs a service and the service has a key performance indicator (KPI) defined by a first search query that derives a value indicative of the performance of the service at a point in time or during a period of time, the value derived from machine data identified in entity definitions for one or more entities that provide the service.
The non-transitory computer readable storage medium of claim 27 wherein the deriving content descriptive of the entity includes extracting information from machine data from multiple sources.
The non-transitory computer readable storage medium of claim 27 wherein the identifying an entity having information generated by or about the entity among the machine data comprises accessing the machine data using a late-binding schema.
The non-transitory computer readable storage medium of claim 27 further comprising:
- determining whether the entity definition satisfies filter criteria for identifying entities associated with the service;
- and
- associating the entity definition with a service definition for the service in accordance with said determining.
Dependencies are inferred from the claim text.