Processing of Performance Data and Structure Data by Thresholding Log Data
AssigneeSplunk Inc.
InventorsBrian BINGHAM, Tristan FLETCHER, Alok Anant BHIDE
Life of this patent
Estimating the term…
Abstract
The disclosed system and method acquire and store performance measurements relating to performance of a component in an information technology (IT) environment and log data produced by the IT environment, in association with corresponding time stamps. The disclosed system and method correlate at least one of the performance measurements with at least one of the portions of log data.
Claims30
A method comprising:
- acquiring, by a computer system, a plurality of performance measurements for each of at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment;
- acquiring, by the computer system, a plurality of portions of log data representing activity of at least one hardware or software component of the IT environment;
- correlating, by the computer system, at least one of the portions of log data with at least one of the performance measurements, by
- determining that one of the portions of log data has a specified relationship to a threshold value, and
- in response to determining that said one of the portions of log data has the specified relationship to the threshold value, identifying at least one of the performance measurements that has a time stamp corresponding to a time stamp of said one of the portions of log data;
- and
- causing display of an indication of correlation between said one of the portions of log data and the identified at least one of the performance measurements.
A non-transitory machine-readable storage medium for use in a processing system of a data intake and query system, the non-transitory machine-readable storage medium storing instructions, an execution of which in the processing system causes the processing system to perform operations comprising:
- acquiring a plurality of performance measurements for each of at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment;
- acquiring a plurality of portions of log data representing activity of at least one hardware or software component of the IT environment;
- correlating at least one of the portions of log data with at least one of the performance measurements, by
- determining that one of the portions of log data has a specified relationship to a threshold value, and
- in response to determining that said one of the portions of log data has the specified relationship to the threshold value, identifying at least one of the performance measurements that has a time stamp corresponding to a time stamp of said one of the portions of log data;
- and
- causing display of an indication of correlation between said one of the portions of log data and the identified at least one of the performance measurements.
A system comprising:
- a communication device through which to communicate on a computer network;
- and
- at least one processor operatively coupled to the communication device and configured to perform operations including
- acquiring a plurality of performance measurements for each of at least one performance metric associated with at least one hardware or software component of an information technology (IT) environment;
- acquiring a plurality of portions of log data representing activity of at least one hardware or software component of the IT environment;
- correlating at least one of the portions of log data with at least one of the performance measurements, by
- determining that one of the portions of log data has a specified relationship to a threshold value, and
- in response to determining that said one of the portions of log data has the specified relationship to the threshold value, identifying at least one of the performance measurements that has a time stamp corresponding to a time stamp of said one of the portions of log data;
- and
- causing display of an indication of correlation between said one of the portions of log data and the identified at least one of the performance measurements.
Dependencies are inferred from the claim text.